owasp-modsecurity / owasp-modsecurity/ModSecurity-nginx

SecRuleScript in chain rules

Open
#213 4 comments 0 reactions 1 assignee View on GitHub

@martinhsv is already working on this.

Since Jun 8, 2020.

nostale
Dominant language
Perl
Stars
1.9k
Forks
312
PR merge metrics
No merged PRs in 30d

Description

Hi, so I want to execute SecRuleScript as part of a chain rule but the script executes independent of the other rules.

Inside vhost of domain mydomain.com, I have the following:

    modsecurity on;
    modsecurity_rules '
    SecDebugLogLevel 9
    SecDebugLog /var/log/nginx/modsec_debug
    SecRule SERVER_NAME "@streq myotherdomain.com" "id:34443223,phase:1,deny,chain"
      SecRuleScript /tmp/test.lua "deny"
    ';

As you can see, I am deliberately comparing mydomain.com to myotherdomain.com through the @streq operation and it is failing as can be seen in the corresponding audit logs:

[1635b64bbf696aefbee6836ccd3b6f2c]  [4] (Rule: 34443223) Executing operator "StrEq" with param "myotherdomain.com" against SERVER_NAME.
[1635b64bbf696aefbee6836ccd3b6f2c]  [9] Target value: "mydomain.com" (Variable: SERVER_NAME)
[1635b64bbf696aefbee6836ccd3b6f2c]  [4] Rule returned 0.
[1635b64bbf696aefbee6836ccd3b6f2c]  [9] Matched vars cleaned.
[1635b64bbf696aefbee6836ccd3b6f2c]  [4]  Executing script: /tmp/test.lua.
[1635b64bbf696aefbee6836ccd3b6f2c]  [1]
[1635b64bbf696aefbee6836ccd3b6f2c]  [9] Returning from lua script: The IP Address 1.1.1.1 found in file
[1635b64bbf696aefbee6836ccd3b6f2c]  [9] Running action: log
[1635b64bbf696aefbee6836ccd3b6f2c]  [9] Saving transaction to logs
[1635b64bbf696aefbee6836ccd3b6f2c]  [9] Running action: auditlog
[1635b64bbf696aefbee6836ccd3b6f2c]  [9] Saving transaction to logs
[1635b64bbf696aefbee6836ccd3b6f2c]  [4] Running (disruptive)     action: deny.
[1635b64bbf696aefbee6836ccd3b6f2c]  [8] Running action deny
[1635b64bbf696aefbee6836ccd3b6f2c]  [8] Skipping this phase as this request was already intercepted.

But still the lua script at /tmp/test.lua is executing. Also, since the SecRuleScript is part of a chain rule, we shouldn't be giving any action to the SecRuleScript but if no action is specified, it generates a syntax error.

Just wanted to confirm are we not able to execute SecRuleScript as part of chain rules? The slides at https://www.slideshare.net/RobertRowley/teaching-your-waf-new-tricks although quite dated but it suggests that SecRuleScript can be run as part of a chain rule.

It would be great if we can run SecRuleScript in chain rules since implementing ipMatchFromFile with CIDR format IPs is a pain to implement in plain lua.

Version Info
libmodsecurity and modsecurity-nginx both have been checked out from the repo two days earlier so I believe both are latest master branches.

Thank you very much.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.