Hi,
I am testing mod_security with 2.0.48 on Solaris 8.
mod_security as been setup as a DSO.
My problem is that the very simple directory traversal directive ( below)
does not work:
SecFilter "\.\./"
The other directives preventing SQL injection or XSS work fine for me.
I have configured mod_security to return a HTTP 500 error and i am testin=
g
the directory traversal directly from the command line with the runtest.p=
l
script.
Exemple:
./run-test.pl webserver1:666 ./03-evasion-traversal.test
I get a HTTP error of 404 instead of 500.
Here 's the request received in the log file:
[08/Jan/2004:18:20:25 +0100] 17.30.5.160 SSLv3 DHE-RSA-AES256-SHA "GET
/cgi-bin/dummy/../modsec-test.pl/keyword HTTP/1.0" 4954
( Just to show it has not been altered between the client and the server)
Note that I have tested the request through a SSL tunnel because Apache
only listens on a SSL port.
Running mod_security in debug mode gives me this:
[08/Jan/2004:18:31:08 +0100]
[webserver1/sid#188130][rid#21a528][/cgi-bin/modsec-test.pl/keyword]
Checking signature "\.\./" at THE_REQUEST
It's strange cause I don't see any "regex_result: 17 is_allow: 0"
that i see for the other rules. Exemple:
[08/Jan/2004:18:31:08 +0100]
[webtest1/sid#188130][rid#21a528][/cgi-bin/modsec-test.pl/keyword]
check_sig_against_string: string
: /cgi-bin/modsec-test.pl/keyword regex_result: 17 is_allow: 0
Am i missing something?
Thanks in advance,
Luc
Here 's my complete configuration
############################################################
# Turn the filtering engine On or Off
SecFilterEngine On
# Make sure that URL encoding is valid
SecFilterCheckURLEncoding On
# Only allow bytes from this range ( ASCII caracters from 32 to 126)
# Avoid some of the buffer overflow attacks
SecFilterForceByteRange 32 126
# Default action for security filters
SecFilterDefaultAction "deny,log,status:500"
# Mask the signature of the server
SecServerSignature "Microsoft-IIS/6.0"
# The audit engine works independently and
# can be turned On of Off on the per-server or
# on the per-directory basis
SecAuditEngine RelevantOnly
# The name of the audit log file
SecAuditLog /var/log/httpd/audit_log
# SecFilterDebugLog /var/log/httpd/modsec_debug_log
# SecFilterDebugLevel 0
# Should mod_security inspect POST payloads
SecFilterScanPOST On
SecFilterSelective THE_REQUEST "///"
SecFilterSelective THE_REQUEST "/\.\.\.\."
# Prevent path traversal (..) attacks
SecFilter "\.\./"
# WEB-MISC Apache Chunked-Encoding worm attempt
SecFilter "CCCCCCC\: AAAAAAAAAAAAAAAAAAA"
# WEB-MISC WEB-INF access
SecFilterSelective THE_REQUEST "/WEB-INF"
# WEB-MISC weblogic view source attempt
SecFilterSelective THE_REQUEST "\.js\x70"
# Weaker XSS protection but allows common HTML tags
SecFilter "<( |\n)*script"
# Prevent XSS atacks (HTML/Javascript injection)
SecFilter "<(.|\n)+>"
# Prevent SQL injection attacks
SecFilter "delete[[:space:]]+from"
SecFilter "insert[[:space:]]+into"
SecFilter "select.+from"
|
