owasp-modsecurity / owasp-modsecurity/ModSecurity
Modsecurity sees the HTTP "INVALID" method instead of "PATCH"
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Hello,
I installed modsecurity 2 on IIS 10 in reverse-proxy with the OWASP csr.
For the moment, the WAF works in DetectionOnly and therefore does not block anything. I authorized in the csr-setup.conf the HTTP PATCH method, but I see that when the PATCH method is used, it is blocked by Modsecurity because PATCH is replaced by INVALID, but the application works correctly, because IIS is authorized to use PATCH and in the IIS logs, it is well written PATCH. I don't understand why Modsecurity receives INVALID.
Could you please help me?
have a nice day
KP
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the PATCH request through ModSecurity 2 on IIS 10 in the reverse-proxy setup, using the OWASP CRS and the authorization in csr-setup.conf. Compare the method recorded by IIS with the method ModSecurity receives; done means identifying why PATCH becomes INVALID or documenting the missing information needed to resolve it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100