SPAM MEDIUM * Re: LOW * AW: [Modsecurity] A little problem with excludes

Thu Oct 11 10:08:40 EDT 2007

Unfortunately, the exclude support is a little lacking in modsec right
now.  You can't exclude via Location matches with regexps, only literals
(index.php will work, index.php?foo=.*bar=.*)  What you have to do is
write a chained rule to exclude, like this:

Say you have a rule (it sounds like you using 1.9.x, so I'll stick to
that syntax):

SecFilterSelective ARGS "foo+bar"

To exclude your case for this, you need to add this:

SecFilterSelective REQUEST_URI "!(^/index\.php
\?option=com_cmsrealty&Itemid=[0-9]&openrealty=)" chain
SecFilterSelective ARGS "foo+bar"

On Thu, 2007-10-11 at 11:55 +0200, Cristian Livadaru wrote:
> Hi, this doesn't seem to work with Version 1.9.4
> 
> 
> Invalid command 'SecRuleRemoveById', perhaps misspelled or defined by
> a module not included in the server configuration
> It's the same way the original excludes.conf is configured. 
> I somehow think my Location doesn't quite match but I don't see why. 
> 
> 
> Cris
> 
> On Oct 11, 2007, at 11:48 , Thomas Ammermann wrote:
> 
> > Hi Christian,
> > 
> > 
> > I usually exclude rules like this:
> > 
> > 
> > <LocationMatch "xxx">
> >     SecRuleRemoveById 300018
> > </LocationMatch>
> > 
> > 
> > Maybe this helps ...
> > 
> > 
> > Kind regards,
> > Thomas
> > 
> > 
> > 
> > 
> > -----Ursprüngliche Nachricht-----
> > Von: modsecurity-bounces at gotroot.com
> > [mailto:modsecurity-bounces at gotroot.com] Im Auftrag von Cristian
> > Livadaru
> > Gesendet: Donnerstag, 11. Oktober 2007 11:29
> > An: modsecurity at gotroot.com
> > Betreff: [Modsecurity] A little problem with excludes
> > 
> > 
> > Hi modsecurity list, 
> > 
> > 
> > I seem to have a little problem with the excludes
> > 
> > 
> > I have this in my Audit log: 
> > 
> > 
> > 
> > 
> > ==6d394431==============================
> > 
> > 
> > Request: www.foo.com 127.0.0.1 - - [11/Oct/2007:09:25:57 +0200]
> > "POST
> > /index.php?option=com_cmsrealty&Itemid=4&openrealty=616374696f6e3d656469745f
> > 6c697374696e677326616d703b656469743d3336392661646d696e3d74727565
> > HTTP/1.1"
> > 403 285
> > "http://www.foo.com/component/option,com_cmsrealty/Itemid,4/openrealty,61637
> > 4696f6e3d656469745f6c697374696e677326616d703b656469743d3336392661646d696e3d7
> > 4727565/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.7)
> > Gecko/20070914 Firefox/2.0.0.7" - "-"
> > ----------------------------------------
> > POST
> > /index.php?option=com_cmsrealty&Itemid=4&openrealty=616374696f6e3d656469745f
> > 6c697374696e677326616d703b656469743d3336392661646d696e3d74727565
> > HTTP/1.1
> > Host: www.foo.com
> > User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.1.7)
> > Gecko/20070914 Firefox/2.0.0.7
> > Accept:
> > text/xml,application/xml,application/xhtml
> > +xml,text/html;q=0.9,text/plain;q=
> > 0.8,image/png,*/*;q=0.5
> > Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
> > Accept-Encoding: gzip,deflate
> > Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
> > Keep-Alive: 300
> > Connection: keep-alive
> > Referer:
> > http://www.foo.com/component/option,com_cmsrealty/Itemid,4/openrealty,616374
> > 696f6e3d656469745f6c697374696e677326616d703b656469743d3336392661646d696e3d74
> > 727565/
> > Content-Type: application/x-www-form-urlencoded
> > Content-Length: 510
> > mod_security-action: 403
> > mod_security-message: Access denied with code 403. Pattern match
> > "((alter|create|drop)[[:space:]]+(column|database|procedure|table)|
> > delete[[:
> > space:]]+from|update.+set.+=)" at POST_PAYLOAD [id "300015"] [rev
> > "1"] [msg
> > "Generic SQL injection protection"] [severity "CRITICAL"]
> > 
> > 
> > 510
> > action=update_listing&edit=369&title=Altbau-Miete&pclass%5B%
> > 5D=4&featured=no
> > &edit_active=yes&mlsexport=no&or_owner=9&notes=&Adresse=Staudgasse&Stadt=Wie
> > n&Postleitzahl=1180&Preis=530&betr_kosten=&miete=&full_desc=Nette
> > +Kleine+Zim
> > mer+und+Kabinett+Wohnung%2C+Einbauk%FCche%2C+sehr+ger%E4umig%2C
> > +Fliesenbad%2
> > C+Toilette+Etagenheizung.Ruhelage+und+AKH+N%
> > E4he&Zimmer=2&Badezimmer=1&year_
> > built=1970&sq_feet=45&status=Aktiv&home_features%5B%5D=Einbauk%
> > FCche&home_fe
> > atures%5B%5D=Gasetagenheizung&home_features%5B%5D=Lift
> > 
> > 
> > HTTP/1.1 403 Forbidden
> > Content-Length: 285
> > Keep-Alive: timeout=15, max=89
> > Connection: Keep-Alive
> > Content-Type: text/html; charset=iso-8859-1
> > --6d394431--
> > 
> > 
> > 
> > 
> > but in excludes.conf I have added:
> > 
> > 
> > # cms_realty
> > <LocationMatch "/index.php\?option=com_cmsrealty.*">
> > SecFilterRemove 300015
> > </LocationMatch>
> > 
> > 
> > I don't understand why this is still blocking. What am I doing
> > wrong? 
> > 
> > 
> > Regards, Cristian
> > 
> > 
> > 
> > 
> > --
> > Cristian Livadaru
> > http://livadaru.net
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > _______________________________________________
> > Modsecurity mailing list
> > Modsecurity at gotroot.com
> > http://lists.gotroot.com/mailman/listinfo/modsecurity
> > 
> > 
> 
> --
> Cristian Livadaru
> http://livadaru.net
> 
> 
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Modsecurity mailing list
> Modsecurity at gotroot.com
> http://lists.gotroot.com/mailman/listinfo/modsecurity
-- 
Michael T. Shinn                                    KeyID:0xDAE2EC86
Key Fingerprint:  1884 E657 A6DF DF1B BFB9 E2C5 DCC6 5297 DAE2 EC86
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xDAE2EC86
SANS Advisory Board Member

Got Root?  http://www.gotroot.com
modsecurity rules: http://www.modsecurityrules.com
Troubleshooting Firewalls:  http://troubleshootingfirewalls.com

****SPAM**** MEDIUM * Re: LOW * AW: [Modsecurity] A little problem with excludes

SPAM MEDIUM * Re: LOW * AW: [Modsecurity] A little problem with excludes