mod-security-users — General discussion about mod_security

Re: [mod-security-users] http-version

[Tom A. <tan...@oa...>]

I have SecAuditEngine set to "RelevantOnly", but the log is getting filled 
up with "HTTP/1.0 200 OK" entries every three minutes from my web host 
checking the connection with "check_http/1.24.2.4 (nagios-plugins )".  I 
don't have any rules that return 200... they all return 406.  Why is it 
logging these?  There are no mod_security headers attached.

I tried to work around the problem by matching "check_http" in the user 
agent and giving it a "nolog,deny,status:200", but apparently the 
"status:200" overrules the deny directive as the page is still output, and 
apparently the "nolog" command doesn't apply to the audit log.

Desired/expected behavior:

1) it shouldn't add any unmatched requests to the audit log when set to 
RelevantOnly
2) "deny" command with "status:200" should just return the 200 header 
without any data
3) "nolog" should apply to the audit log too

Tom

Re: [mod-security-users] http-version

[Ivan R. <iv...@we...>]

Tom Anderson wrote:
> ----- Original Message ----- From: "Ivan Ristic" <iv...@we...>
> 
>>   The variable that works is SERVER_PROTOCOL. There's one problem,
>>   though. Apache handles requests with invalid protocol versions long
>>   before the request is passed on to mod_security for analysis. That's
>>   why it always responds with 400.
> 
> Is there a way to redirect the 400 response?  I tried it with 
> ErrorDocument, but it didn't seem to work.  I guess it doesn't pass the 
> error document request back through mod_security.  In fact, it didn't 
> even fetch the error document for 400 at all, but just returned its 
> generic 400 error message.

   That's what I get too. And, no, I don't know a way to get round it.

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] apache-monitor error

[Ivan R. <iv...@we...>]

Rudi Starcevic wrote:
> Hi,
> 
> I just downloaded the latest version of the apache security tools from 
> http://www.apachesecurity.net/
>
 > ...
 >
> Just before line 59 to try and find why there is a parse error ...
> 
> This is the output:
> 
> BusyWorkers: 132
> IdleWorkers: 35
> Scoreboard: 
> W.___K___KCKK_K_.CWW_GGGW___WKGKC__GKKW.WG_W_WK__KK_GK_.KWWW_KWKW.

   Some things seem to be missing from the output. Do you have
   ExtendedStatus set to On (in the Apache configuration)?

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] apache-monitor error

[Rudi S. <te...@wi...>]

Hi,

I just downloaded the latest version of the apache security tools from=20
http://www.apachesecurity.net/

This is my error :

=2E/apache-monitor /root/scripts/httpd/server-status=20
http://myserver.com/server-status/?auto

Failed to parse URL output at ./apache-monitor line 59.

This is line 59:

my %data =3D parse_page("URL output", $page);
if (!%data) {  die("Failed to parse URL output"); }

So I added

print $page;
exit(0);

Just before line 59 to try and find why there is a parse error ...

This is the output:

BusyWorkers: 132
IdleWorkers: 35
Scoreboard:=20
W.___K___KCKK_K_.CWW_GGGW___WKGKC__GKKW.WG_W_WK__KK_GK_.KWWW_KWKW.KCGWGK_=
KGWKKW.GGKKGWWK_G.W_GK_GKW.GW_GKW.GWGWK_.KKWGK.K.GGG.KWGRWK.KKCWGCK.WGW_G=
GKCG_GWGW_KGGG.K___.GK.KKKWKWW_K_............G.............C.............=
=2E....G...G.....G..............G........................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E......................................................................=
=2E.....................................................


Hmm .. seems like it should all be working fine.

Can anyone please advise on how to get over this error ??

Many thanks
Regards
Rudi

Re: [mod-security-users] http-version

[Tom A. <tan...@oa...>]

----- Original Message ----- 
From: "Ivan Ristic" <iv...@we...>
>   The variable that works is SERVER_PROTOCOL. There's one problem,
>   though. Apache handles requests with invalid protocol versions long
>   before the request is passed on to mod_security for analysis. That's
>   why it always responds with 400.

Is there a way to redirect the 400 response?  I tried it with ErrorDocument, 
but it didn't seem to work.  I guess it doesn't pass the error document 
request back through mod_security.  In fact, it didn't even fetch the error 
document for 400 at all, but just returned its generic 400 error message.

Tom

Re: [mod-security-users] Sanity.A - phpbb worm

[Michael H. <gno...@al...>]

Thanks for all the good tips so far.  The environments involved are shared
hosting servers and, unfortunately, it seems not everyone got the email :)
We continue to see the sanity worm getting uploaded and are having some
trouble tracking down the culprits, so we're looking to other measures whil=
e
we sort out the real problem.


On 1/31/05 11:25 AM, "Ivan Ristic" <iv...@we...> wrote:

> Michael Hochradel wrote:
>> First off, let me say thanks for making such a great product and
>> maintaining this mailing list so the newbies like me can get some
>> answers on things.  My question, obviously, relates to the sanity worm.
>>  I saw on the main page the post from Dec 22 regarding this rule:
>>=20
>> SecFilterSelective ARG_highlight %27
>>=20
>> I=B9m wondering how effective this is and if there are any new strains I
>> need to be aware of or any other advice from the community about dealing
>> with this worm.
>=20
>    The rule should work for new strains but haven't examined the
>    vulnerability in great detail to determine if there are other ways
>    to break PHPBB. You should upgrade to the latest PHPBB version -
>    that's the best advice anyone can give you.



--Gnomercy
AlphaOmegaHosting.Com, Inc.
Customer Support Supervisor

Re: [mod-security-users] server response ordering

[Ivan R. <iv...@we...>]

Tom Anderson wrote:
> Is there any way to change the order of fields output by Apache using
> mod_security?  Eg, IIS and Netscape output the server field, then the
> date field, but Apache does the date first.  To help prevent
> fingerprinting, I'd like to reorder the fields.  

   No, because that's not something you can do with Apache (without
   changing the source code). Apache hard-codes two of the headers,
   Date and Server and there's nothing one can do about it.

   Therefore the only way to hide Apache is to put a reverse proxy
   in front of it and instruct the reverse proxy to shuffle the
   headers. But even if you did that you would still have to handle
   some other signs you are running Apache - the contents of the
   ETag header, for example.

   Header shuffling is potentially useful when Apache is used as
   a reverse proxy. In this mode of operation Apache will use the
   headers received from the remote server and not send its own. The
   only drawback of this solution is that it is trivial to discover
   the identity of the Apache reverse proxy. Just send it a bad
   request.

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] http-version

[Ivan R. <iv...@we...>]

Tom Anderson wrote:
> I'm trying to determine how to match the HTTP protocol version passed in
> from the client in order to help prevent fingerprinting.  For example,
> if the request is "GET / HTTP/3.0", Apache generally returns "400 Bad
> Request" while IIS returns "200 OK", and Netscape returns "505 HTTP
> Version Not Supported".  I'd like to be able to match the HTTP version
> string in order to change the response to 505 or 406 or something else. 
> However, none of the "locations" for SecFilterSelective seem to work. 

   The variable that works is SERVER_PROTOCOL. There's one problem,
   though. Apache handles requests with invalid protocol versions long
   before the request is passed on to mod_security for analysis. That's
   why it always responds with 400.

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Sanity.A - phpbb worm

[Ivan R. <iv...@we...>]

Michael Hochradel wrote:
> First off, let me say thanks for making such a great product and=20
> maintaining this mailing list so the newbies like me can get some=20
> answers on things.  My question, obviously, relates to the sanity worm.=
=20
>  I saw on the main page the post from Dec 22 regarding this rule:
>=20
> SecFilterSelective ARG_highlight %27
>=20
> I=92m wondering how effective this is and if there are any new strains =
I=20
> need to be aware of or any other advice from the community about dealin=
g=20
> with this worm.

   The rule should work for new strains but haven't examined the
   vulnerability in great detail to determine if there are other ways
   to break PHPBB. You should upgrade to the latest PHPBB version -
   that's the best advice anyone can give you.

--=20
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Sanity.A - phpbb worm

[Gerwin K. <ge...@di...>]

Well this will help to protect against the bug in phpbb2. But I would=20
also advice you to use the following rules:

SecFilterSelective ARGS "wget\x20"
SecFilterSelective ARGS "perl\x20"
SecFilterSelective ARGS "curl\x20"
SecFilterSelective ARGS "fwrite"
SecFilterSelective ARGS "fopen"
SecFilterSelective ARGS "chr\("
SecFilterSelective ARGS "echr\("
SecFilterSelective ARGS "system\("

these will protect you big time for other buggy php code too! I hope=20
this will help you a little.

Michael Hochradel wrote:

> First off, let me say thanks for making such a great product and=20
> maintaining this mailing list so the newbies like me can get some=20
> answers on things. My question, obviously, relates to the sanity worm.=20
> I saw on the main page the post from Dec 22 regarding this rule:
>
> SecFilterSelective ARG_highlight %27
>
> I=92m wondering how effective this is and if there are any new strains =
I=20
> need to be aware of or any other advice from the community about=20
> dealing with this worm.

[mod-security-users] server response ordering

[Tom A. <tan...@oa...>]

Is there any way to change the order of fields output by Apache using
mod_security?  Eg, IIS and Netscape output the server field, then the
date field, but Apache does the date first.  To help prevent
fingerprinting, I'd like to reorder the fields.  

Tom

[mod-security-users] http-version

[Tom A. <tan...@oa...>]

I'm trying to determine how to match the HTTP protocol version passed in
from the client in order to help prevent fingerprinting.  For example,
if the request is "GET / HTTP/3.0", Apache generally returns "400 Bad
Request" while IIS returns "200 OK", and Netscape returns "505 HTTP
Version Not Supported".  I'd like to be able to match the HTTP version
string in order to change the response to 505 or 406 or something else. 
However, none of the "locations" for SecFilterSelective seem to work. 
HTTP_VERSION at least doesn't return an error, but it doesn't match the
http version string either.  Please let me know if what I want to do is
possible, and if so, how to do it.  Thanks.

Tom

[mod-security-users] Sanity.A - phpbb worm

[Michael H. <gno...@al...>]

First off, let me say thanks for making such a great product and maintainin=
g
this mailing list so the newbies like me can get some answers on things.  M=
y
question, obviously, relates to the sanity worm.  I saw on the main page th=
e
post from Dec 22 regarding this rule:

SecFilterSelective ARG_highlight %27

I=B9m wondering how effective this is and if there are any new strains I need
to be aware of or any other advice from the community about dealing with
this worm.

Re: [mod-security-users] How do I block mail attempts?

[Ivan R. <iv...@we...>]

Mark wrote:
> I have no proxy running on the web server. The exploit attempt
> was simply something I found in the mod_security log (trapped for
> other reasons). I compiled the web server to disallow relays on port 25,
> and it does. I just wanted mod_security to log attempts of such.

   That I have time to check. Try this:

   SecFilterSelective REQUEST_URI ^http:/.+:25

   (I didn't test it with a proxy compiled into Apache.)

-- 
Ivan Ristic (http://www.modsecurity.org)

RE: [mod-security-users] How do I block mail attempts?

[Mark <ad...@as...>]

> -----Original Message-----
> From: Ivan Ristic [mailto:iv...@we...] 
> Sent: zondag 30 januari 2005 23:43
> To: Mark
> Cc: eli...@ex...; mod...@li...
> Subject: Re: [mod-security-users] How do I block mail attempts?
> 
 
>    I am guessing you have a reason for running a proxy on
>    that web server?

I have no proxy running on the web server. The exploit attempt
was simply something I found in the mod_security log (trapped for
other reasons). I compiled the web server to disallow relays on port 25,
and it does. I just wanted mod_security to log attempts of such.

- Mark

Re: [mod-security-users] How do I block mail attempts?

[Ivan R. <iv...@we...>]

> I am talking about HTTP POST/PUT relaying, which can be exploited
> by encoding SMTP requests into HTTP POST data (or a PUT request
> in the same format). Example: 

   I am guessing you have a reason for running a proxy on
   that web server?

   Try this (Apache 2.x syntax):

   <Proxy *>
       RewriteEngine On
       # Do not allow proxy requests to target port 25 (SMTP)
       RewriteRule "^proxy:[a-z]*://[^/]*:25(/|$)" "-" [F,NC,L]
   </Proxy>

   It is probably possible to do something with mod_security too
   but I don't have time at the moment to verify it. On the other
   hand I know the solution above works

-- 
Ivan Ristic (http://www.modsecurity.org)

RE: [mod-security-users] How do I block mail attempts?

[Mark <ad...@as...>]

> -----Original Message-----
> From: Eli [mailto:eli...@ex...] 
> Sent: zondag 30 januari 2005 22:45
> To: 'Mark'; mod...@li...
> Subject: RE: [mod-security-users] How do I block mail attempts?
> 
> Mark wrote: 
> 
> > How do I block mail attempts, like below?
> >
> >    "POST http://67.234.73.188:25/ HTTP/1.1"
> >
> > Would this do it?
> >
> >    SecFilter "\:25\/"
> 
> Why is your webserver listening on port 25?

I am talking about HTTP POST/PUT relaying, which can be exploited
by encoding SMTP requests into HTTP POST data (or a PUT request
in the same format). Example: 

>>> POST http://mx.victim.com:25/ HTTP/1.0
>>> Host: http://mx.victim.com:25/
>>> Content-Length: {length of request body in bytes}
>>>
>>> HELO foo
>>> MAIL FROM:<su...@sp...>
>>> RCPT TO:<vi...@vi...>
>>> DATA
>>> You've been spammed!
>>> .
>>> QUIT
<<< 220 victim.com ESMTP
<<< 503 unimplemented
<<< 503 unimplemented
<<< 503 unimplemented
<<< 503 unimplemented
<<< 503 unimplemented
<<< 250 hello
<<< 250 sender ok
<<< 250 recipient ok
<<< 354 go ahead
<<< 250 message accepted for delivery
<<< 221 victim.com goodbye

I want to prevent those via the POST payload.

> The $ in a regex is *end of line*, not end of a word 
> boundary.  If the last part of the ENTIRE line you
> want to filter is .exe or whatever, then yes a $
> at the end will work.  In this case though, not so good.

I guess a "\b" instead will work?

Thanks,

- Mark

RE: [mod-security-users] How do I block mail attempts?

[Eli <eli...@ex...>]

Mark wrote: 

> How do I block mail attempts, like below?
>
>    "POST http://67.234.73.188:25/ HTTP/1.1"
>
> Would this do it?
>
>    SecFilter "\:25\/"

Why is your webserver listening on port 25?  If it isn't, you can't prevent
people posting to port 25 using mod_security - you need to block it with
your mta software.  Besides, POSTing data to port 25 will never work right -
it isn't SMTP protocol aware and will fail.

> Also, speaking of SecFilter, I have this:
>
>    SecFilter "(\.com|\.exe|\.cmd|\.bat)"
>
> Can I add $ at the end of SecFilter? Like so:
>
>    SecFilter "(\.com|\.exe|\.cmd|\.bat)$"
>
> I only want to match on patterns ending in this!

The $ in a regex is *end of line*, not end of a word boundary.  If the last
part of the ENTIRE line you want to filter is .exe or whatever, then yes a $
at the end will work.  In this case though, not so good.

I suggest using the other SecFilter thing (sorry, can't remember the
directive) that allows you to filter on certain CGI variables.  Filter it on
whatever one you need - file uploads or uri.

Eli.

[mod-security-users] How do I block mail attempts?

[Mark <ad...@as...>]

How do I block mail attempts, like below?

    "POST http://67.234.73.188:25/ HTTP/1.1"

Would this do it?

    SecFilter "\:25\/"

Also, speaking of SecFilter, I have this:

    SecFilter "(\.com|\.exe|\.cmd|\.bat)"

Can I add $ at the end of SecFilter? Like so:

    SecFilter "(\.com|\.exe|\.cmd|\.bat)$"

I only want to match on patterns ending in this!

Thanks,

- Mark

RE: [mod-security-users] Wget filter

[Tkachenko A. <al...@tk...>]

Exactly!
Thank you!..


Alexey.
 

-----Original Message-----
From: Ivan Ristic [mailto:iv...@we...] 
Sent: Friday, January 28, 2005 10:34
To: Tkachenko Alexei
Cc: 'Oliver Schneider'; mod...@li...
Subject: Re: [mod-security-users] Wget filter

Tkachenko Alexei wrote:
> Thank you, Oliver.
> 
> Still don't understand why my filter block and "wget" also :(

   Because "wget+" in "SecFilter wget+" is a regular expression.
   The "+" at the and means "one or more characters". In this
   case it applies to the letter "t".

   So it matches "wget", but it would match "wgett" or
   "wgetttttttttt" too.

   What do you want to block with that signature? You have to
   remember that something like:

   "cd%20.temp22;wget%20http://".

   looks to mod_security as:

   "cd .temp22;wget http:/".

   (read the part in the manual that discusses anti-evasion)

   Finally, it seems to me you want to use "wget ".

   Another word of warning: "wget " is *very* broad. Be careful
   not to block legitimate requests.

--
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] [Fwd: blocking upload of .php files]

[Ivan R. <iv...@we...>]

> Hi, is it possible to block a file upload based on file extension?

   The short answer is yes. The exact solution depends of the
   modsecurity version you are using.


> I can't block php files by blocking content-type text/plain, because I 
> don't want to block .txt files.

   Both the content type and the filename of the file being uploaded
   are supplied by the client. A malicious user could, therefore, forge
   any or both of them.


> There is no rule to filter for filename extension specifically, right?

   There isn't in the 1.8.x branch but there is in the 1.9.x branch.
   In 1.9dev1 I added several variables related to file upload. This is
   a part of the CHANGES (http://www.modsecurity.org/download/CHANGES)
   file:

     * New variables added: FILE_NAME_*, FILE_SIZE_*, FILE_NAMES,
     FILE_SIZES, FILES_COUNT, HEADER_*, HEADERS, HEADERS_NAMES,
     HEADERS_VALUES, HEADERS_COUNT, ARGS_COUNT, COOKIES_COUNT

   But because the information provided in FILE_NAMES cannot be
   trusted the attacker is still able to upload a PHP file although
   not with a ".php" extension. So the following would still be
   possible:

   1. Someone uploads a PHP file with an extension .gif. Let's assume
      it goes to "/g/image.gif".

   2. He then proceeds to exploit another flaw in the application
      where he injects the "/g/image.gif" filename into an
      include() PHP statement. By doing this he gets to execute
      code on the server.

   There is a better way. You can write a simple script to be executed
   with SecUploadApproveScript. The script will be executed with the
   filename to the file on disk as the only parameter. The script needs
   to read the file and look for "<%" or "<?" strings. If found the file
   is likely to be a PHP file.

   Actually, the best approach is to perform both checks (only possible
   with 1.9.x). First for the filename and then for the file content.


> <Location /cms>
> SecFilterInheritance Off
> SecFilterSelective "HTTP_CONTENT_TYPE" multipart/form-data chain
> SecFilterSelective POST_PAYLOAD "filename=\"[[:print:]]+\.php\""
> </Location>

   This does not work because modsecurity never gives you access to
   a multipart/form-data body directly. Such a body is too complex
   (plus it can contain binary data) to be evaluated using regular
   expressions.

-- 
Ivan Ristic (http://www.modsecurity.org)

[mod-security-users] [Fwd: blocking upload of .php files]

[Ivan R. <iv...@we...>]

-- 
Ivan Ristic (http://www.modsecurity.org)

Re: [mod-security-users] Wget filter

[Ivan R. <iv...@we...>]

Tkachenko Alexei wrote:
> Thank you, Oliver.
> 
> Still don't understand why my filter block and "wget" also :(

   Because "wget+" in "SecFilter wget+" is a regular expression.
   The "+" at the and means "one or more characters". In this
   case it applies to the letter "t".

   So it matches "wget", but it would match "wgett" or
   "wgetttttttttt" too.

   What do you want to block with that signature? You have to
   remember that something like:

   "cd%20.temp22;wget%20http://".

   looks to mod_security as:

   "cd .temp22;wget http:/".

   (read the part in the manual that discusses anti-evasion)

   Finally, it seems to me you want to use "wget ".

   Another word of warning: "wget " is *very* broad. Be careful
   not to block legitimate requests.

-- 
Ivan Ristic (http://www.modsecurity.org)

RE: [mod-security-users] Wget filter

[Tkachenko A. <al...@tk...>]

Thank you, Oliver.

Still don't understand why my filter block and "wget" also :(


Alexey. 


-----Original Message-----
From: Oliver Schneider [mailto:Bor...@gm...] 
Sent: Friday, January 28, 2005 01:43
To: Tkachenko Alexei
Cc: mod...@li...
Subject: Re: [mod-security-users] Wget filter

Privet,

> 1) My logs always contain "wget+" but no "wget%" even if the following 
> request was blocked "cd%20.temp22;wget%20http://".
> Why so? Why my log does not contain "wget%" at all?

%20 is the escaped version of a blank space. (0x20 is the hexadecimal
representation of the character code 32 which is a blank space).

wget+ represents exactly the same, because blank space has two different
representations in this encoding scheme: + and %20.

Seems that Apache internally decodes %20 but not + which is natural since +
may be a valid filename character. Hence you would find "wget " but not
"wget%".

By the way: this will only filter WGET calls (executing WGET), WGET itself
allows to mimic any browser and cannot be blocked as a client.

Oliver

--
---------------------------------------------------
May the source be with you, stranger ;)

ICQ: #281645
URL: http://assarbad.net

Re: [mod-security-users] Wget filter

[Oliver S. <Bor...@gm...>]

Privet,

> 1) My logs always contain "wget+" but no "wget%" even if the following
> request was blocked "cd%20.temp22;wget%20http://".
> Why so? Why my log does not contain "wget%" at all?

%20 is the escaped version of a blank space. (0x20 is the hexadecimal
representation of the character code 32 which is a blank space).

wget+ represents exactly the same, because blank space has two different
representations in this encoding scheme: + and %20.

Seems that Apache internally decodes %20 but not + which is natural since +
may be a valid filename character. Hence you would find "wget " but not
"wget%".

By the way: this will only filter WGET calls (executing WGET), WGET itself
allows to mimic any browser and cannot be blocked as a client.

Oliver

-- 
---------------------------------------------------
May the source be with you, stranger ;)

ICQ: #281645
URL: http://assarbad.net