owasp-modsecurity / owasp-modsecurity/ModSecurity-nginx
Basic modsecurity setup with nginx docker image responds with HTML content but with content-type of text/plain
Nobody has claimed this yet.
- Dominant language
- Perl
- Stars
- 1.9k
- Forks
- 312
- PR merge metrics
- No merged PRs in 30d
Description
When testing out the basic features of modsecurity, I tried accessing a non-existing page which is included by threat scanning tools to see how modsecurity would handle it. I was happy to see that the request resulted in a generic 403 response but instead of the HTML rendering in the browser it was displayed in plain text. When checking, it looks like the content-type of the response was text/plain when it really should have been text/html.
Additionally, the server header in the response was disclosing that the underlying system was using nginx which is a concern due to disclosure of the underlying technology, and which allows attackers narrow their possible set of attacks. In the same way, the default 403 error message show below also references nginx. My recommendation, if possible, would be to configure this product to remove these headers and to use something generic which does not signal anything unique to clue an attacker in on the use of modsecurity or nginx.
Image: owasp/modsecurity-crs:nginx
Example URL: http://localhost:8080/.env
Response:
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx</center>
</body>
</html>
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
<!-- a padding to disable MSIE and Chrome friendly error page -->
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the response with the owasp/modsecurity-crs:nginx image and the example URL http://localhost:8080/.env. Inspect the nginx connector and image configuration responsible for the 403 response; done means the response renders as HTML with content-type text/html and no longer discloses nginx or ModSecurity details.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, nginx
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100