owasp-modsecurity / owasp-modsecurity/ModSecurity

'SecResponseBodyAccess Off' does not prevent response body from being logged (SecRuleEngine == DetectionOnly)

Open
#2,425 2 comments 0 reactions 1 assignee View on GitHub

@zimmerle is already working on this.

Since Dec 1, 2020.

3.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Hi!
Setting SecResponseBodyAccess to Off does not prevent response body from being logged ( SecAuditLogParts ABIJDEFHZ)

Does it mean that with SecResponseBodyAccess Off ResponseBody is still being intercepted?

Expected behaviour - according to https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#SecAuditLogParts "E: Intermediary response body (present only if ModSecurity is configured to intercept response bodies... Intercepting response bodies requires SecResponseBodyAccess to be enabled"

Server:

  • ModSecurity version: ModSecurity v3.0.4
  • WebServer: nginx-1.18.0
  • OS (and distro): Ubuntu 16.04

Rule Set :
https://github.com/coreruleset/coreruleset/archive/v3.3.0.tar.gz

Additional context
SecRuleEngine == DetectionOnly and SecAuditLogType == Concurrent
Removing E from SecAuditLogParts do prevent ResponseBody from being logged.
If I set SecRuleEngine to On and turn on DEBUG logging - logs do confirm that SecResponseBodyAccess is not ignored (https://github.com/SpiderLabs/ModSecurity/commit/42a472adbda21e6ecc4711fd37d704cdb3d98fbb):
Response body is disabled, returning... 1

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.