1

I've just installed CRS for Apache mod_security and it's reporting all PDF files as possible attacks. Specificaly, it's the modsecurity_crs_20_protocol_violations.conf that's causing the trouble saying those files begin with 0.

When a user tries to download any PDF file I get this log (domain name changed):

[Tue Jul 08 15:02:40.695235 2014] [ratelimit:error] [pid 6875:tid 140072931452672]
[client 149.255.82.154:57722] AH01457: rl: brigade pass failed., referer: 
http://example.com/downloads/
[Tue Jul 08 15:02:41.081811 2014] [:error] [pid 6875:tid 140072923059968] [client 
149.255.82.154] ModSecurity: Warning. String match "bytes=0-" at 
REQUEST_HEADERS:Range. [file "/etc/httpd/crs/activated_rules
/modsecurity_crs_20_protocol_violations.conf"] [line "428"] [id "958291"] [rev "2"] 
[msg "Range: field exists and begins with 0."] [data "bytes=0-65535"] [severity 
"WARNING"] [ver "OWASP_CRS/2.2.9"] [maturity "6"] [accuracy "8"] [tag 
"OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "example.com"] [uri 
"/app/files/broz_pd.pdf"] [unique_id "U7vr8X8AAAEAABrbRKQAAACB"]

I tried to whitelist PDF files by creating a modsecurity_15_whitelist.conf and adding this:

SecRule ".*\.pdf$" "phase:1,id:158963,t:none,nolog,noauditlog,pass"

(and restarting Apache) with no success.

Could anyone help me to get rid of these false positives?

1 Answer 1

0

Add this line on /etc/modsecurity/modsecurity.conf file and restart apache.

SecRule REQUEST_URI ".*\.(pdf|jpeg|png|xml)\?$" "phase:1,id:1001,nolog,t:urlDecode,t:lowercase,t:normalizePath,ctl:ruleRemoveById=958291"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.