2

I have configured my anomaly scoring level to 8 within my CRS-setup.conf When I review my audit log I see the following entry:

--f0d8a724-H--
Message: Warning. detected XSS using libinjection. [file "/etc/httpd/modsecurity.d/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "64"] [id "941100"] [rev "2"] [msg "XSS Attack Detected via libinjection"] [data "Matched Data:  found within ARGS:page: /One-Initial-Bordered-Card?cross-sell=1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"]
Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client %s] ModSecurity: %s%s [uri "%s"]%s
Apache-Handler: application/x-httpd-php
Stopwatch: 1512753208830562 28609 (- - -)
Stopwatch2: 1512753208830562 28609; combined=1561, p1=361, p2=888, p3=55, p4=215, p5=41, sr=54, sw=1, l=0, gc=0

If I switch my SecRuleEngine to on instead of debug, would the above event be blocked? Am I correct to assume since that event did not exceed the anomaly score of 8 that it would have allowed this request? I have other events in my audit log which clearly state they exceed the threshold of 8, so is it a fair assumption that unless the audit log specifically states it exceeded the threshold, that the request would NOT be blocked?

If that is the case, is there a way to configure the audit log to only log events which would be blocked in the event of SecRuleEngine being set to on? I do not want to see any partial matches in my audit log that do not exceed threshold levels.

2

If I switch my SecRuleEngine to on instead of debug, would the above event be blocked? Am I correct to assume since that event did not exceed the anomaly score of 8 that it would have allowed this request? I have other events in my audit log which clearly state they exceed the threshold of 8, so is it a fair assumption that unless the audit log specifically states it exceeded the threshold, that the request would NOT be blocked?

Yes that is correct.

If that is the case, is there a way to configure the audit log to only log events which would be blocked in the event of SecRuleEngine being set to on? I do not want to see any partial matches in my audit log that do not exceed threshold levels.

No there is not. And this is one of the main reasons I dislike anomaly mode scoring. Even once you switch it on you will see this noise. The only way to know if an attack will be blocked is if the anomaly check runs run at the end (rule ids 949110 - 949118) fire.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.