owasp-modsecurity / owasp-modsecurity/ModSecurity
request on iis with more than 999 characters single value in cookie are getting blocked and no specific rule to fix
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
using owasp mod security on iis version 2.9.7, after june update the following bug started to happen
requests with a single cookie variable value of longer than 999 characters are being blocked with err connection reset or http protocol 2 error, no specific reason for the error is being logged.
note that its per variable length not on the total length of the cookie, so requests with two cookie variables each for example is 800 characters will pass.
no logs in the event viewer, and no clear rule id to find out what is happening.
disabling modsecurity the requests passes without a problem.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the issue with ModSecurity 2.9.7 on IIS using a single cookie value longer than 999 characters, then compare the request behavior with ModSecurity disabled. Done means the request behavior and applicable rule or logged cause are identified, with a focused regression test or documented reproduction.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100