I don't know if i understand all:
I did next change:
SecRule ARGS|ARGS_NAMES "@validateByteRange 1-255" \
"deny,log,auditlog,status:400,msg:'Invalid character in request',,i=
d:'960901',severity:'4',phase:2"
SecRule ARGS|ARGS_NAMES|REQUEST_HEADERS:Referer "@validateByteRange 1-255" =
\
"deny,log,auditlog,status:400,msg:'Invalid character in request',,i=
d:'960901',severity:'4',t:urlDecodeUni,phase:2"
----------------------------------------> Subject: RE: [mod-security-users]=
%00 char and 960901 rule> Date: Tue, 25 Sep 2007 07:55:07 -0400> From: Ofe=
rS@...> To: bermejator@...; mod-security-users@...=
orge.net>> Well, this is a bug and a feature:>> I will start with the bug. =
The rule correctly tries to identify encoded null character in the request =
as those have no valid use and are used in many exploits and evasion techni=
ques.>> However the rule implicitly performs double decoding as ARGS are de=
coded when parsing and than the rule itself performs a urlDecodeUni transfo=
rmation. So you wrote "%00". The browser sent "%2500", encoding the percent=
sign which is OK. Than we decoded to "%00" and again to a null character, =
on which we alerted.>> We have an open ticket to split the rule to two, one=
handling ARGS & ARGS_NAMES that are already decoded and the other location=
which should be decoded.>> As to the feature: saying all that, an applicat=
ion sometimes double decode, so a %00 in the input might be dangerous. It i=
s hard to protect a web site that deals with technology, and more specifica=
lly with security. Just think about this e-mail: would it pass an applicati=
on firewall?>> ~ Ofer>> Ofer Shezaf> ofers@..., Phone:+972-9-9560036=
#212, Cell: +972-54-4431119>> Leader, ModSecurity Core Rule Set Project;> =
CTO, Breach Security; Chair, OWASP Israel;>>>> -----Original Message----->>=
From: mod-security-users-bounces@... [mailto:mod->> secu=
rity-users-bounces@...] On Behalf Of Ruben Lara>> Sent: T=
uesday, September 25, 2007 1:08 PM>> To: mod-security-users@...=
ge.net>> Subject: [mod-security-users] %00 char and 960901 rule>>>>>> Hi,>>=
Im trying to post in my phpbb forum a line wich contain %00 char and i>> g=
et a false positive:>>>> [Mon Sep 24 21:41:29 2007] [error] [client 192.168=
.1.50] ModSecurity:>> Access denied with code 400 (phase 2). Found 1 byte(s=
) outside range:>> 1-255. [id "960901"] [msg "Invalid character in request"=
] [severity>> "WARNING"] [hostname "www.bermejator.com"] [uri>> "/forum/pos=
ting.php?mode=3Dedit&f=3D33&sid=3D1bbae563df5ac108526808f52b7b24d1>> &t=3D1=
3&p=3D19"] [unique_id "zo1qB8CoAW4AASoSC7UAAAAF"]>>>> Why this char is out =
of range=BF? how can i solve it=BF?>>>> Thank u>> Rub=E9n Lara>>=20
_________________________________________________________________
Llama a tus amigos de PC a PC: =A1Es GRATIS!
http://get.live.com/messenger/overview=
|