0

I'm relatively new to ModSecurity and I have been trying to get my head around the rules for weeks. When saving a page in WordPress I was getting the following in modsecurity_audit.log:

Message: Warning. detected XSS using libinjection. [file "/etc/apache2/modsecurity.d/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "64"] [id "941100"]
 [rev "2"] [msg "XSS Attack Detected via libinjection"] [data "Matched Data: cookie found within ARGS:data: {\x22status\x22:\x22publish\x22,\x22id\x22:107,\x22attributes\x22:
 {\x22post_title\x22:\x22https://domain-name/Home Page\x22,\x22post_parent\x22:\x220\x22,\x22post_excerpt\x22:\x22\x22},\x22meta\x22:{\x22_wp_page_template\x22:
 \x22page-blank.php\x22,\x22_footer\x22:\x22normal\x22,\x22_thumbnail_id\x22:\x22\x22},\x22content\x22:{\x22tag\x22:\x22_root\x22,\x22options\x22:{\x22$responsive\x22:{}},
 \x22states\x22:{},\x22children\x22:[{\x22tag\x22:\x22ux_bann..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "9"] [tag "application-multi"]
 [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag

And this:

Message: Warning. Pattern match "(?i)<[^\\w<>]*(?:[^<>\"'\\s]*:)?[^\\w<>]*(?:\\W*?s\\W*?c\\W*?r\\W*?i\\W*?p\\W*?t|\\W*?f\\W*?o\\W*?r\\W*?m|\\W*?s\\W*?t\\W*?y\\W*?l\\W*?e|\\W*?s\\W*?v
\\W*?g|\\W*?m\\W*?a\\W*?r\\W*?q\\W*?u\\W*?e\\W*?e|(?:\\W*?l\\W*?i\\W*?n\\W*?k|\\W*?o\\W*?b\\W*?j\\W*?e\ ..." at ARGS:data. 
[file "/etc/apache2/modsecurity.d/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "236"] [id "941160"] [rev "2"]
 [msg "NoScript XSS InjectionChecker: HTML Injection"] [data "Matched Data: \x22status\x22:\x22publish\x22,\x22id\x22:107,\x22attributes\x22:
 {\x22post_title\x22:\x22https://domain-name/Home Page\x22,\x22post_parent\x22:\x220\x22,\x22post_excerpt\x22:\x22\x22},\x22meta\x22:
 {\x22_wp_page_template\x22:\x22page-blank.php\x22,\x22_footer\x22:\x22normal\x22,\x22_thumbnail_id\x22:\x22\x22},\x22content\x22:{\x22tag\x22:\x22_root\x22,
 \x22options\x22:{\x22$responsive\x22:{}},\x22states\x22:{},\x22children\x22:[{\x22tag\x22:\x22ux_banner\x22,\x22options\x22:{\x22$res..."] [severity

To get around it I have added the following:

SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \
        "id:9002002,\
        phase:1,\
        t:none,\
        nolog,\
        pass,\
        ctl:ruleRemoveById=941100,\
        ctl:ruleRemoveById=941160"

But I think that solution could be more detailed to make it more specific to the actual characters/item that is causing it to fail rather than removing the entire rule and potentially leaving me exposed. But for the life of me I am struggling to figure it out.

I am running the latest version of ModSecurity and the latest rule set, based on anomaly scoring.

migrated from security.stackexchange.com Sep 20 '18 at 12:55

This question came from our site for information security professionals.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy