owasp-modsecurity / owasp-modsecurity/ModSecurity
lua script can not access XML variable
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
m.getvars("XML") return null
To Reproduce
- setup modsecurity
docker run -ti --rm -p 8083:80 -e ERRORLOG=/tmp/nginx_error.log -e MODSEC_DEBUG_LOG=/tmp/debug.log -e MODSEC_AUDIT_LOG=/tmp/audit.log -e BACKEND=http://10.56.58.13:8888 docker.io/owasp/modsecurity-crs:3.3.5-nginx-alpine-202401080101
replace BACKEND address to yours
- edit
modsecurity.conf
/etc/modsecurity.d # grep lua *
modsecurity.conf:SecRuleScript "/tmp/2.lua" "id:23333,phase:2,deny"
- create lua script
-- File operation function
function writeToFile(filepath, content)
local file, err = io.open(filepath, "a") -- "w" stands for write mode
if file == nil then
error("Couldn't open file: "..err)
else
file:write(content.."\n")
file:close()
end
end
-- Test function
function test(x)
local status, err = pcall(writeToFile, "/tmp/test.txt", x)
if not status then
print("Error: " .. err)
end
end
-- Main function
function main()
local inspect = require("inspect") -- The inspect library needs to be installed separately https://github.com/kikito/inspect.lua
local vars = inspect(m.getvars("PATH_INFO")) -- Print the PATH_INFO variable to standard error
test(vars)
test("4444")
local vars = inspect(m.getvars("XML"))
test("XML"..vars)
return nil;
end
- send http request
POST /webtools/control/SOAPService HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36
Connection: close
Content-Length: 355
Content-Type: application/xml
Accept-Encoding: gzip
<?xml version='1.0' encoding='UTF-8'?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header/>
<soapenv:Body>
<ns1:clearAllEntityCaches xmlns:ns1="http://ofbiz.apache.org/service/">
<ns1:cus-obj></ns1:cus-obj>
</ns1:clearAllEntityCaches>
</soapenv:Body>
</soapenv:Envelope>
- look up /tmp/test.log
Expected behavior
Expected behavior: /tmp/test.log has information abount XML variable
Actual behavior:
/tmp/test.log content is below
{ {
name = "PATH_INFO",
value = "/webtools/control/SOAPService"
} }
4444
And some error occur
2024/01/19 08:00:42 [alert] 1#1: worker process 90735 exited on signal 6
terminate called after throwing an instance of 'std::invalid_argument'
what(): Variable not found.
Server (please complete the following information):
- ModSecurity version (and connector): [e.g. ModSecurity v3.0.8 with nginx-connector v1.0.3]
- WebServer: nginx/1.25.3
- OS (and distro): linux
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Lua m.getvars("XML") entry point and reproduce the failure using the supplied ModSecurity configuration, Docker image, and SOAP request. Compare its behavior with m.getvars("PATH_INFO") and verify that requesting the XML variable returns information without terminating the nginx worker.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, lua, nginx
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100