在 ModSecurity 规则中添加例外 (SecRuleUpdateTargetById) 不起作用？

Question

我已经在 nginx 中安装了 ModSecurity，并在此 documentation 的帮助下安装了 OWASP CRS。

除了其中一条规则拒绝有效请求外，一切正常。我收到 403 拒绝访问错误。原因似乎是我的 URL 参数或请求正文中有一个键名 imagebase64。

这个 rule file 导致我遇到拒绝访问问题。规则如下：

SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/* "@rx (?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b" \
    "id:941130,\
    phase:2,\
    block,\
    capture,\
    t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
    msg:'XSS Filter - Category 3: Attribute Vector',\
    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
    tag:'application-multi',\
    tag:'language-multi',\
    tag:'platform-multi',\
    tag:'attack-xss',\
    tag:'OWASP_CRS/WEB_ATTACK/XSS',\
    tag:'WASCTC/WASC-8',\
    tag:'WASCTC/WASC-22',\
    tag:'OWASP_TOP_10/A3',\
    tag:'OWASP_AppSensor/IE1',\
    tag:'CAPEC-242',\
    ctl:auditLogParts=+E,\
    ver:'OWASP_CRS/3.1.0',\
    severity:'CRITICAL',\
    setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
    setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"

这是日志（我更改了实际的端点、令牌等，保持生成的日志不变）：


---kmzyGTME---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b' against variable `ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64' (Value: `json.some.randomStuff.randomList.array_0.imageBase64' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "139"] [id "941130"] [rev "2"] [msg "XSS Filter - Category 3: Attribute Vector"] [data "Matched Data: eBase64 found within ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64: json.some.randomStuff.randomList.array_0.imageBase64"] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"] [hostname "00.00.2.1"] [uri "/some/fake/endpoint"] [unique_id "83423785723453523523.234324234"] [ref "o47,7v0,54t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "44"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver ""] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "00.00.0.0"] [uri "/some/fake/endpoint"] [unique_id "156150510827.687874"] [ref ""]
ModSecurity: Warning. Matched "Operator `Ge' with parameter `5' against variable `TX:INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/owasp-modsecurity-crs-3.0.2/rules/RESPONSE-980-CORRELATION.conf"] [line "65"] [id "980130"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): XSS Filter - Category 3: Attribute Vector"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [tag "event-correlation"] [hostname "00.00.0.0"] [uri "/some/fake/endpoint"] [unique_id "238472356327653256235.2352353"] [ref ""]

我尝试通过在规则文件中添加以下行来添加 imagebase64 作为例外键：

SecRuleUpdateTargetById 941130 !ARGS_NAMES:imagebase64

我参考了 this 参考手册。它对我不起作用。

但是，直接使用 (?<!imagebase64) 在正则表达式中添加异常是可行的。

我做错了什么？如何修改规则以仅接受 imagebase64 作为键？

Answer 1

错误日志条目包含以下片段：

data "Matched Data: eBase64 found within ARGS_NAMES:json.some.randomStuff.randomList.array_0.imageBase64

所以参数名称不是imageBase64而是json.some.randomStuff.randomList.array_0.imageBase64

您需要包含完整的参数名称，或与之匹配的正则表达式。

在 ModSecurity 规则中添加例外 (SecRuleUpdateTargetById) 不起作用？

Adding exceptions (SecRuleUpdateTargetById) in ModSecurity rule does not work?

nginx

owasp

mod-security