owasp-modsecurity / owasp-modsecurity/ModSecurity
libModSecurity3: REQUEST_HEADERS names are treated as case sensitive with configure-time rule-exclusions
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
Describe the bug
This bug is similar to: https://github.com/owasp-modsecurity/ModSecurity/issues/3441, which also doesn't appear in ModSecurity2.
Logs and dumps
N/A
To Reproduce
Re-using the previous example in this issue, say I have this rule:
SecRule REQUEST_HEADERS:Referer "@contains <evil-string>" \
"id:2,\
phase:1,\
deny,\
t:none,\
log"
and I want to write a rule-exclusion for this rule via a configure-time rule-exclusion:
SecRuleUpdateTargetById 2 !REQUEST_HEADERS:referer
This rule-exclusion works if the client sends a lowercase referer header:
$ curl -H "referer: <evil-string>" localhost:8080
But if the client sends an uppercase referer header, then the request is wrongly blocked:
$ curl -H "Referer: <evil-string>" localhost:8080
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>nginx/1.28.3 (Ubuntu)</center>
</body>
</html>
If I exclude both uppercase and lowercase referer header, then the rule-exclusion works as expected.
SecRuleUpdateTargetById 2 !REQUEST_HEADERS:Referer
SecRuleUpdateTargetById 2 !REQUEST_HEADERS:referer
Expected behavior
Request header case should be ignored.
Server (please complete the following information):
- OS: Ubuntu 26.04
- ModSecurity Version: 3.0.17
- NGINX Connector Version: v1.0.4
- NGINX Version: 1.28.3
Rule Set (please complete the following information):
N/A
Additional context
Similar to: https://github.com/owasp-modsecurity/ModSecurity/issues/3441
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing configure-time rule exclusions from SecRuleUpdateTargetById to matching REQUEST_HEADERS targets. Reproduce the issue with the two curl requests and compare exclusions for Referer and referer. Done means header-name casing is ignored, so one exclusion behaves consistently for both requests, with coverage for the regression.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, nginx
- Domain
- backend-api-design, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100