owasp-modsecurity / owasp-modsecurity/ModSecurity

The SCRIPT_* family of variables can be accessed in phase 1 and returns invalid data

Open
#235 2 comments 0 reactions 2 assignees View on GitHub

@victorhora is already working on this.

Since May 20, 2017.

enhancement
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

MODSEC-85: Here's a fragment from a debug log:

[4] Recipe: Invoking rule 9b001d8; [file "/opt/modsecurity/etc/rules.conf"] [line "6"].
[5] Rule 9b001d8: SecRule "SCRIPT_BASENAME|SCRIPT_FILENAME|SCRIPT_GID|SCRIPT_GROUPNAME|SCRIPT_MODE|SCRIPT_UID|SCRIPT_USERNAME" "@rx 222" "phase:1,log,auditlog,pass"
[4] Expanded "SCRIPT_BASENAME|SCRIPT_FILENAME|SCRIPT_GID|SCRIPT_GROUPNAME|SCRIPT_MODE|SCRIPT_UID|SCRIPT_USERNAME" to "SCRIPT_GID|SCRIPT_GROUPNAME|SCRIPT_MODE|SCRIPT_UID|SCRIPT_USERNAME".
[4] Transformation completed in 2 usec.
[4] Executing operator "rx" with param "222" against SCRIPT_GID.
[9] Target value: "0"
[4] Operator completed in 31 usec.
[4] Transformation completed in 2 usec.
[4] Executing operator "rx" with param "222" against SCRIPT_GROUPNAME.
[9] Target value: "root"
[4] Operator completed in 2 usec.
[4] Transformation completed in 2 usec.
[4] Executing operator "rx" with param "222" against SCRIPT_MODE.
[9] Target value: "0000"
[4] Operator completed in 2 usec.
[4] Transformation completed in 2 usec.
[4] Executing operator "rx" with param "222" against SCRIPT_UID.
[9] Target value: "0"
[4] Operator completed in 2 usec.
[4] Transformation completed in 2 usec.
[4] Executing operator "rx" with param "222" against SCRIPT_USERNAME.
[9] Target value: "root"
[4] Operator completed in 2 usec.
[4] Rule returned 0.

I think the correct thing to do in this case is for the variable to not-resolve and the rule not to run.

At the same time, a warning should be emitted that an attempt to access a variable that is not yet available was made.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.