4

We are getting a lot of False Positives from using 3rd part software on our server. They themselves can't seem to fix it and I'm trying to work out how to allow cookies through that contain "CERTAINSTRING_"

Below is an example of one of the bans. They are all the same rule id

www.mysite.com  27.33.154.111   981231  [15/Dec/2013:12:14:36 +1100]

Pattern match: \
"(/\\*!?|\\*/|[';]--|--[\\s\\r\\n\\v\\f]|(?:--[^-]*?-)|([^\\-&])#.*?[\\s\\r\\n\\v\\f]|;?\\x00)" \
at REQUEST_COOKIES: _CERTAINSTRING. \
[file "/usr/local/apache/conf/modsecurity_crs_41_sql_injection_attacks.conf"] \
[line "49"] \
[id "981231"] \
[rev "2"] \
[msg "SQL Comment Sequence Detected."] \
[data "Matched Data: 1#"
      "description::325,1091,/file-path/file-name/999/1,http://www.mysite.com/file-path/file-name/999/1#"
      "rev found within REQUEST_COOKIES:_CERTAINSTRING: 240,1091,/file-path/file-name/999/1,http://www.mysite.com/file-path/file-name/999/1#"
      "description::325,1091,/file-path/file-name/999/1,http://www.mysite…”] \
[severity "CRITICAL"] \
[ver "OWASP_CRS/2.2.8"] \
[maturity "8"] \
[accuracy "8"] \
[tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] \
[tag "WASCTC/WASC-19"] \
[tag "OWASP_TOP_10/A1"]
4
  • 1
    Oh. My. God. Before vomiting what looks like the output of an errant lineprinter into the "Ask Question" box, please take a moment to explain the problem to the Rubber Duck the nature of the exact problem you are trying to solve, and reduce the problem scope down to a single manageable question. Thanks.
    – MikeyB
    Dec 18 '13 at 2:26
  • What is your question? Dec 18 '13 at 2:47
  • 1
    @AndrewSchulman: If you had ever worked with mod_security you'd know ...
    – user9517
    Dec 18 '13 at 8:20
  • 1
    @MikeyB the question was there. We are gettig false positives and I wanted to whitelist the thing that was causing them. Wht's so duifficult to understand about that? Why be such a high and mighty fwit about it? iain seemed to know exactly what i was talking about and gave me the working answer within about 5 mins of me posting. No attitude, just the help I was seeking. Don't be such a dck.
    – starchild
    Dec 19 '13 at 2:38
5

You can use SecRuleUpdateTargetById to modify the rule

SecRuleUpdateTargetById 981231 !REQUEST_COOKIES:/^ _CERTAINSTRING/

Which would disable the rule that is causing you pain for request cookies whose name begins with _CERTAINSTRING.

Update:

The rule above needs to be placed after the rule to which it refers is defined. This is normally done by creating a file that is read after all of the CRS rules e.g. based on the location referenced in your audit log message

/usr/local/apache/conf/modsecurity_crs_61_customrules.conf

5
  • 1
    you are a star, I will try this now.
    – starchild
    Dec 17 '13 at 23:23
  • and sorry, into which file does this get entered?
    – starchild
    Dec 17 '13 at 23:29
  • yeah, I worked that out. Cheers again.
    – starchild
    Dec 19 '13 at 2:38
  • sorry @iain - didn't realise i had to. Done
    – starchild
    Dec 19 '13 at 23:24
  • In cpanel, where this file should be included? Aug 4 '16 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.