owasp-modsecurity / owasp-modsecurity/ModSecurity
AuditLogs are logging binary data and getting huge
@zimmerle is already working on this.
Since Apr 3, 2020.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
My audit logs have begun logging binary data under the C section for request body.
This is causing my log files to grow upwards of 5GB each even though they rotate once daily.
I am running the following system:
ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/) configured. [-]
ModSecurity: APR compiled version="1.6.2"; loaded version="1.6.3"
ModSecurity: Loaded APR do not match with compiled!
ModSecurity: PCRE compiled version="8.39 "; loaded version="8.39 2016-06-14"
ModSecurity: LUA compiled version="Lua 5.1"
ModSecurity: YAJL compiled version="2.1.0"
ModSecurity: LIBXML compiled version="2.9.4"
I have numerous websites that are using ModSecurity through Apache but this only occurs with my installation of Nextcloud and only when very large video files (500MB and up) are uploaded from the Nextcloud app interface on my phone.
In my modsecurity.conf file I have the following set:
SecAuditLogParts ABDEFHIJZ
Removing the I fixes the issue for me so I am guessing that somehow modsecurity isn't recognizing that these particular body requests are a file upload of binary data. Maybe because the data is sent in chunks. I don't know.
Logs and dumps
Output of:
- DebugLogs (level 9)
- AuditLogs
- Error logs
- If there is a crash, the core dump file.
Notice: Be carefully to not leak any confidential information.
To Reproduce
Steps to reproduce the behavior:
A curl command line that mimics the original request and reproduces the problem. Or a ModSecurity v3 test case.
[e.g: curl "modsec-full/ca/..\..\..\..\..\..\/\etc/\passwd" or issue-394.json]
Expected behavior
A clear and concise description of what you expected to happen.
Server (please complete the following information):
- ModSecurity version (and connector): libapache2-mod-security2 2.9.2-1
- WebServer: Apache 2.4.29
- OS (and distro): Ubuntu 18.04.4
Rule Set (please complete the following information):
OWASP ModSecurity Core Rule Set ver.3.2.0
Additional context
Add any other context about the problem here.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.