search

SpiderLabs / owasp-modsecurity-crs

OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)
https://modsecurity.org/crs
Apache License 2.0
2.45k stars 727 forks source link

Simple Base64 Post Forbidden #1043

Closed luizbiazus closed 6 years ago

luizbiazus commented 6 years ago

The rules are catching simple base64 uploads, it's not suppose to work without whitelist rules?


---7fZlosHV---A--
[16/Mar/2018:15:23:41 +0000] 152121382116.209189 127.0.0.1 41184 127.0.0.1 4443
---7fZlosHV---B--
POST /api/logo/cliente?cliente_id=11983 HTTP/1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.186 Safari/537.36
X-Forwarded-Proto: https
Accept: application/json, text/plain, */*
Content-Length: 8524
Connection: close
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOjEsImlzcyI6Imh0dHBzOi8vYXBpLnB1bHNhcnBheS5jb20vYXBpL3VzdWFyaW8vbG9naW4iLCJpYXQiOjE1MjEyMTM4MDMsImV4cCI6MTUyMTIxNzQwMywibmJmIjoxNTIxMjEzODAzLCJqdGkiOiI1SGJFS29MaERyY1hBcHN3In0.QEo_2KI4ZVVZh1s1fmsbUgIxbNbd-JSh9iRa2NUp_Vo
Host: api.XXXXXXXXXXXXXX.com
Origin: http://localhost:4200
X-Forwarded-For: 186.208.81.157
X-Real-IP: 186.208.81.157
Content-Type: application/json
Referer: http://localhost:4200/clientes
Accept-Encoding: gzip, deflate, br
Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7

---7fZlosHV---D--

---7fZlosHV---F--
HTTP/1.0 302
Server: nginx/1.13.9
Date: Fri, 16 Mar 2018 15:23:41 GMT
Content-Length: 161
Content-Type: text/html
Connection: close
Location: https://site.XXXXXXXXXXXXXXX.org/public/error/forbidden_2.html

---7fZlosHV---H--
ModSecurity: Access denied with code 302 (phase 2). Matched "Operator `Rx' with parameter `(?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b' against variable `ARGS:json.logo_64' (Value: `data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMgAAADICAIAAAAiOjnJAAAAA3NCSVQICAjb4U/gAAAAX3pUWHRSYX (8410 characters omitted)' ) [file "/usr/local/nginx-modsecurity/conf/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "130"] [id "941130"] [rev "2"] [msg "XSS Filter - Category 3: Attribute Vector"] [data "Matched Data: ;base64 found within ARGS:json.logo_64: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAMgAAADICAIAAAAiOjnJAAAAA3NCSVQICAjb4U/gAAAAX3pUWHRSYXcgcHJvZmlsZSB0eXBlIEFQUDEAAAiZ40pPzUstykxWKCjKT8vMSeVSAANjEy4TSxNLo0QDAwMLAwgwNDAwNgSSRkC2OVQo0QAFmJibpQGhuVmymSmIzwUAT7oVaBst2IwAABgpSURBVHic7Z3vbxTFH8d3r7f3o+312qNXqIUWsMY2NViIP4DciSYKbRVjAlEjonJ9pI/0gZHGP4ASn5HoI3IPTDQSTdAYLM9Q9hIwMZYHSjCBUIzJYbG219L2etfefh/s97vfZWZ2dmZ293Z2b1+Putvd2dm7931m5jOf+YyoKIoQEGA3IbcrEOBPAmEFOEIgrABHCIQV4AiBsAIcIRBWgCMEwgpwhEBYAY4QCCvAEXworO7ublHH9u3b3a5RIyL6bEpHkqT19XXMBbt37/7111/rVp+GxT8Wq1AohMNhvKoEQZienp6YmKhPlRoZn1isVCo1Pz9Pfn1fX9/MzIxj1QnwhbBMmz8kkUhkbW3NifoECD5oCqPRKFJVkUhky5YtmBsrlUo0GnWsXo2Ot4U1NjZWqVTg8+l0em1trVgsKv9DkiT4skqloo4c9+zZ43xlGwzFy8CvEw6HZVlGXow3YIIgNDc3K4qSy+UikQjVZ/j+++/X9709gIf7WJFIpFqtAmdMu01sHTJTzp8//8orr9herHfxalN47NgxQFWCIJB0xqvVajgctr0+R44csb1MT+NVYX3zzTfAmZGREcJ7q9VqKGTzi9dqNdoG1N94tSkURVF/GI1Gy+Uy4b2JROL+/fsOVEoIh8OXLl3KZDJOFO4tPGmx4CEeuaqi0aipqlpbW0+cODE/P4/vn8Iman19PZvNdnR0LCwsENbHr3hPWLDjKhaLEd4rSRLSPaESiURUPS0tLeXz+fb2dnxpx48fR55fWFhIpVKnT58mrJU/qcfQ0z7efPNN+BVyuRzJvcg+UCgUeuGFF/L5PFt9Hn74Ycxn29HRwVasD/CMsGRZjsfj8JenOp9MOXnyJHxvMpnE32Xq+jLF9BF+xRud9+7u7rt378LnRVGs1WokJTz22GO///67/gze6dXf33/r1i3aeiJpbW1dWlqypSgP4YE+1rFjx5CqEgTho48+Iixkbm5OfxgKhVRV9ff3ayGBLS0t6n9FUbRLVYIg3L9/f//+/XaV5hncNpnmGPmHduzYQV5IT0+P/t7e3l7FoH10iKmpKcc+IR7xgLDgLymRSBhNCBqxc+dOfQmDg4OKojQ3N9dLV0IoFHLm4+EU3pvCvXv3AmdkWV5cXKR1QnZ2duoPN23aJJBNAQmC0NTUhPkECTv4tVrN1H/hJ3gX1s8//6w/jMVibH5tIL5U7bSl02nTG4eHh/GT1lpwDuBOg+tZKpUSiQRpjT0O18J67733gDMvv/wyW1HAjLUqrGKxiJk0jEQiiqJMT08TPmJ1dVXTTTqdlmX58ccfB65poI58PdpbVgYHB+2q7djYmL6cuvV4kEGqjdCR59piAe1XR0cHc1Gffvqp/rBWqxEupujv7w+FQsxRpuVyGR4iHD58mKEob8G1sFZWVvSHVuKotm/fDrR6H3/8seldExMTt27dUhRFsLBubHl5GXj0+vr66OgoQ1EegmthAWEIFgOegBkhYFiA5MqVK5hDci5cuACcuXjxIltRXoFrYQHTNQcOHLBSmupi0CCRaX9/v/5w3759ptcj282RkRG4vwgPTXyF2508Q55++ml7q/rUU0/pS8tkMiR3afELw8PD+CsBP/7JkyeBC4DXGRoaYnwTL2B/9LddwB4s2hLg1RYM3Lx5k/BK03YzmUyWSiXtUP+3/+C0KbTowVKnlvGqAqalrWPabi4uLuoPfb4O222TiYbZg4WPvNOjzkPbC6bdhNd6OFEBfuC0KQR+zd3d3fjrC4XC2NgYVdiTFiRjI5h2Ex4GvvHGG7ZXgB84FVZTU5P+ED9929TURBjupwcYJDoK3LLH4/FTp07VrQL1h9M+FuAaXV5eRl5WKBRCoZCpqtSG6ZFHHtGftL2PheHHH38EzgAv6D84tVirq6v6Q1g6RsHKAMPDw9osMqFYneDGjRv6QytzU16BU4sFDKCA6TZJkkxVpVopfWwCMB9M1ccC8ppqkEwgJhIJ5UEn1kMPPUT+aI/CqbCAEKgnnnhC+xuf1UOLLIXDXZCxfjDvvPNOU1MTICAjHU9PTwNrsgHi8Ti8PrYRJqF5dDfAwyXtX5h56HA4jC+WxPN+/vx5hs8wHo8jn4hMJ0G4Xs3r8GixAJ+7NqmXSCSQtiqVSsmybN3JLgjCtWvXGO4CeoQqCwsLsIshHo/Xs2/nIjwKS3mwR7J161bBoE1Rgzzn5uZI4pWR0ckAbEnh4ZW0p0+fTqVSwMlEIuH7weD/cdtkIgD8AoODg8g2RVUVOYBoWltbkZe9/fbbRvHKmq8c8O8DJRgFtjN8FN6Fx7eF1wDCX5JRtwZDfaKTW1tbkaoaHR114nHcwuMSe8BH1dLSAvRLEokE4I8gYWZmZseOHfozt2/ftndDFKN081u2bCkWizY+iH947GMB8zlw15hBVQIqOvn1119nKMeIeDyOVNXk5GSjqUrg0/O+sbGhPwTc7nAAIDmJREIfBUUSnUzI6OgonPwtGo3evXu3odapavBosfCOg6+++oq55Gw2C5wxSp5GRaFQgD0L6XS6XC43pqoEPnOQYjbGCYVCgD2jBXCUWy8QWVu2XqCf4NFiYXYiMRpzkXP06FH9Ya1WYzZa6gQi8jfQ4KoS+BQW0HnX89xzz1ks/OuvvwaM1hdffMFQTiKRMJpA9P2aQRJ4FBambfr222+tlw8k+1cUBXBD4CkUCpIkGaVe3rZt2w8//GCpfv7AZT8aCsBBqhGLxex6BFz4mTNnTO+SZRkTJI3ZxqcB4VFYQJI0jVdffZW5TH3z19XVBc8tiqI4MzNjdPv8/Dw+fsvfKyMY4LEpNOpjnTt3jq1AdfZGO5ydnd28eTPwFAWao9RQZ5SNohLa2toURblz5w5b3fwKj8JChgAw94gnJiYUqO375Zdf4PS11WoVmE8UBKGtrU1d04wsPJ1O+3vdKTuu2ks08I4mpkF8GJARnkeOHFEU5cyZM/C/9P0kjHdj27ZtQY8KA3fCQn7ZzJnKkHmR0+m0doHRQAFDc3NzIClT+BIWMhkaQ4SMxtDQEFCaaa4OU/r6+iy9ZGPA15QOstlKp9Ozs7NsBba3t+v7QE1NTXBwczabLRQKVMWSbOXa4HDUeTfK+orcQocQoGc9MDAAXyPLMkn6ZD2VSgUz7xQgcCWs69evI88z5zh49tlngTPPPPMM8srZ2VlZlo1CipF2NNAWHo6awoGBgT/++AM4id9hEA8sCOaXNVo8GI/HG2h9BA0cWawbN24AjoZIJMKsKthnASxDpbI3aocUXtW4uroKu74CBK4sll0sLCx0dnaSRFkxmEPkOmxZloN9oAE4sli2oE6/wKpCZpqsVqu0EZ7VahW2W9lsdtu2bVTl+B5fWay2tjZk7rV4PP7kk09evnwZeRf5bpr6W+CTe/fuZc7X7T/8Y7EkSUKqKhKJrKys/PTTT5h1pLRbEyAbvqtXr/o+ezs5PhGWUVqHjo4OzZO5uLioKMr4+Dh82cbGBlVf3sj1NTY2Nj4+vrCwQF6Ub3HJ428nyK0ARFGcnJxEXm+UAJd2zb4sy0ZuiO7ubjvezMN4vo8VjUbhkZ0kSbOzs/iOORCkpdLc3GwUd6VpSN8nu3jxolE8TzKZbGTT5e2mcGJiAlZVPB6vVCqmw71arQZ3rVZWVpA7MemTtimKoh2OjIzs2rULWX6pVGrYRYWC4PGmEG6JkskkVQmwtpAb9QIPEkVR/9+uri6jjxcOpmgQPGyx4NBQURRpW59qtQqIZmNjA3amA9cAYc1///23oii5XA4W+uTkJLwZQkPgtrLZgb9FNvOAHCcC1wAJS/WhggDI3Fp79+5lqJin8aqw4NBQK/mukBOL+guAgWc0GjUqCilToTG269XjVWHB2dgAc6WdB/pDRsBS0HfXADuEFzEsU1ipvser7gZ8bo/Ozk79xhObNm36559/8AUidySIxWLFYrG9vZ02AgdZWkM5IDzZeYe95GoCXI1///0Xc4ikWCzC6imXy6lU6vTp04DFwmSX0EqbmpoCTpZKJcz40W+4bTKpQS68AdpB+IsnLJxw22nCdg3p4mqQPO/eawr7+vr+/PNP/RnYXQ4Ho5LnwWpubkbmbWcrLRaLwcsuGmEthveaQkBVoijCkzBw9EGtVkO61GFWVlaM4iA0yH+N5XI5mUwCJyuVihO7JfKF2yaTDrgdNMrGAb8p4fBQZXJyEr9JTldXF3lpyIVGmzdvJi/Bc3hMWPCv38gpivQnUcUvmGaYoeotIUO+fDzh4zFhUfXK29raLGpLURRZlrds2WKkLSplIE0gVWU8hMf6WICwgH0MAUqlEuyrJAl80JPJZIrFoizLyObsyy+/JC8ql8vBJ5Hq9wNuK5sOwHhs3brV9BZkGxSJRBgSe8iyDJRD1W9TDNwZtNXwBB6zWEAKeJJBO3JdTaVSyWazfX19VFkbMpkMoGxFUQgHmypwhY02hPI8biubDiBhFXn0FcbzKUnS+Pj4/Pw8STnwmIBqEtDeuXOe8bawqH4Y+A6ZhmmWIqpwHVmW8b0ov05Oe0xY8ABt37595LeTbx+PKYQkfov8cVT19xAeExb8pUqSRFUC3n2ggfdKwNf39PRo/yUpX8VKCkzO8ZiwFNSXylCILMumLSPmdji8Qu0qybJsGvig4e/ZaO8NSV577TXgDPl3qZHJZJaXlxWDSGJBt8M5TCqVggd3tVqtubk5m80STk739vb6fNdxt5XNAvwWDD0VfIMFXGzaB8fTgJtWeFJYcPACbWcFk6wBKMrI505OY25a4UlhKZDRovIGGakKsCsWJYVZydMIeFJYwPZdArE3CNO51g8D8ZsxmZJIJBqt4YPxpLD6+vqA79K0j4XvUWmtlUUrFUhKw5PCApIfG7WDuVwOuRJLj2qojPLPkMM2q+1jPCksRVG06OFEIqE/j8mqbaQq5OoMALwZo00Y0Qh4bzGFEePj459//jky/RoSbcOLcDhsZb9xKxtn+BjvOUgBCoVCS0uLKIr5fJ5QValU6rPPPltbW1PzchupyjSgRRRFWZYDVSHxqsVCLjU2pampicQ4pVKp77777vnnn8fHezXUymZaPGaxuru7VTNDqKpIJHLixAk11oqkyVN7S3Nzc5lMxjQ2gXB1a2PiGWGpkiLUU1tbmzpGW1tby+fzv/32WzgcNm0oAQtULBaB1hCIxAr20sHh6tCBFMJ02ZIkafZJgzAGi2TihTxLVoAHLBZylxGAVColy3KlUsnn8+oiHK3RnJ+fx9+lfhAku4UDXS7mfX4aAbrE+fUnGo1iVNXb2wsLwrRfz5w6AVBSuVxmKKRB4NpiIZMiC7pmS6+q/v5+kn59Op1mTsgBrBECDgP0cG2xvv/+e+CMkbFJJBL379/HlxYOhy9dumRlmy7Fm64ZV+BaWPqsfIIgiKIIq4rQoYVsNKmA1w+Szx01IFwLC2hrFIP0BxhszEQFm893333XlpJ9CdeedyuzeNZNFABgGslzrzUmXHfeabcRVBkeHiZ0H1ABmE/ApxUAwHVT2NbWViqVyK/XGr6mpiZVlOFw2K6xW+DEooJri7WwsEDYqVIdEOp3PzAwoJm69fX1gYEBWyoTOLGo4LqPxQbgqbfLaAEdPhttoS/h2mKxAfxUyEP/qHCoWN/gQ2HBm+pSpbAyAl7eI4ri9u3brZfsS3worBdffBE488knn1gvdseOHfDJO3fuiDo6OzupMrn5GB/2sQTUtrwnT548deqU7cVi6Ovrm5mZsfhE7+JDiyWg0shSZaE1ArnbrxF37txp5EhAf1osAbIu+h3CLcIWbq+C2czcZ/jTYgmCsHnzZv2hQpmFFkOxWFRosqvpWVlZ2b9/vy3V4BzfCgvuwtvSGmqo8tIgXyh75coVG6vBLb5tCgWoNazbai3TWGpbRhKcw7vFKhQKyWRSZAL4zVBNO1qhWq3iG0o4Asd/cG2xtLlku+jp6fnrr79sLJAQwHYG+xW6iY3jOA3m0ZxFUqmU/rBSqfjea8+psGgjRQlhG8pZB5lNSfXa79mzp/71qQM8Csshv2IoFHKlHRRQQ1SN6elpu/wgXMFdHysajcIxdKIoXr582coCG9dJJpOLi4vIf/myy8WXxTJaSFir1TytKkEQSqWSUd7ASqXiP6PFl7CQPkySjHue4ObNm//NawBl3jp37pwrVXIOvoS1tLQEnBkeHvafL/HEiRPAmdu3b3d1dblSGadwKtsIEwwbqNanJoRs2rSJMMUtcpzop1ymfFksIEqzzruPaglqyBNxAczNzWWzWbWEWCw2Pj5uNIn01ltvwSdLpRLhpooewG1lP0D9LRZVlmU2kskk0owZGcV4PO70W9cBvoRVt8xmrnhKd+/eDVTDaKeMkZERh168bvAlLCD7nhPCcsv5roLc5BfZ/MEq9BZ8CcvpppA8sFiFfOMu8iYVeTvSbmG2muYfvoQFNIV27fAO771ji5gw5HI5IxEbbftjVB/Tzc/5hC9hwe1ULpezWObIyIipmPTJSG1ElmXYrRCNRpEX46cWPNcy8iUseC/xWCxmsUzMt1WfLSoJhaXoNghC4q2WkbtJaDiu10oNkVPaQn3nfYE0lvgI6UgkYpQSwvaMX47Cl4NUEIR79+4BZ4aGhtiKSqVSRrlxuY0mqFQqRuPWuoVW2wJ3wmpvbwf6JdevX7948SJtORMTE3CG99HRUcWBnGz2oq3/AaId4YlUrnGxGTZibGwMqCTtXuKKosCbzhNu72s7QNwi+YQgbLo81M3izmIJgnDhwgVglnB9fX3fvn1UhcC/7w8//NBqzZgAmt1kMkl4o9NLIx2FR2EJgnDhwgXgzNWrV6kaRHgC+9q1a1arRQ+8QxgmTBng7NmzQGu4urpqT7XqgNsm05Bdu3YBVaVqEB999FH4Zeu8bTMyRJGqBEBYLsYR0cKvsBRUpKXa+yYE+UOq50bzsPOdanYZ1uXQ0JBztbUXroU1NTVl8ReP1JYgCDt37nSozphH085Q9fb2AiV4qPPOtbAURRkcHAQ+XCpfvGksg0Mzcchn0dobINbDrpnT+sBp513j+vXrwJlyuQz7I4woFovIwAENddWovSkejRIVHT58mKocwLvb0tLCXqf647ayzUHOzlL1k2RZjsfjph+FXeFfyMLV/TKoALpokiTZUr364AFhKQZxVF1dXVSFvPTSS6baikQiFqs6OjoKF8tWFGBrGbzELuINYSkGZqC5uZmqEKMlo3osdmXgApl73IGw6oFRuBLz14bp1/f09LCVCWf4sLIywtPC4i5sBkNXVxcc+yBYi6spFAoHDhyA8yVNTU2RRAgC2BvzA2TV8tZGdryPCvXMzs7KsgyftzKsy2QyGxsbsCeWdgSnAgi0zusiucJjb57JZOAoU+HBlaKSJNGKDLYE6+vrx48fZ6+oA3iobREEL7gbYEjei3bqBunlp3XQAybKYq/I6NWsD13rAL/CkmUZjqlig/CJSA8k1eAAdsYyvfp/MX0v8lQR9YcvYdkoJj2JRILk6chGlmrBBexvM1rsRQLh20mSND4+Pj8/z/wgJ+BFWE4vUGauBpU7Hr4dsybHFPxkFEx3dzfzs2zH/c67JEnM2V0IIU/7USwWgckfqi164SA+K4mfaffaLBaLDAMXh3DZj2V7JnckVO8I+KIkSaLaVxzY4Zf26XgI94dKp9Ozs7N2PZQNNy1WNBo1VZUta5SpagU0QMgMaRiOHj0KnIGjk5nRFvDIsozJpHXv3j33XWgWvzNmMJlFHVrwToj1xCTwGzkXoJfL5Yxy4jNPTNmCa8JCfhz1WfOOp6enx2KVjKyFQ/kXjMY96m5CbuGOwZyYmFAe/GWrnwIPS0mBHhJDFxDOXasyPT3NttsUHqNel41NMAPuCAteH3fs2DFXagJjPQ/q2bNn3f1SVT744AM3H++KnURa73qun8EACIt5xZVD2wERwhCwai/uWCzkos2lpaVsNhuNRjHJhh2lUCjAoSnM6UNqtZoraSnVTuH09HT9H/0ArinarImJRCK5XK4OMxX5fP7QoUNG9bE+niAJW7UOD+MePW46SOvjHbVII2yz6wQue94LhcLBgwe5TUkwPDzsfpviTbgITS4UCocOHVpZWXG7Iv8nHA4bZdYLIMFtx78gCIKQyWSWl5cVbLLhutHe3i7LcqAqq7jbxTMil8vRTtJZQZKkgwcP5vN5t9/bP3DRFAb4Dy6awgD/EQgrwBECYQU4QiCsAEcIhBXgCIGwAhwhEFaAIwTCCnCE/wC5vhsTvzUN5gAAAABJRU5ErkJggg=="] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "Host: api.XXXXXXXXXXX.com"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"] [hostname "127.0.0.1"] [uri "/api/logo/cliente"] [unique_id "152121382116.209189"] [ref "o14,7v13,8510t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
csanders-git commented 6 years ago

This is not the base64 that is triggering the rule, it's the data url passing base64. Here's what i mean.

https://regex101.com/r/D5ogMf/1

This is blocked because such encoding mechanisms (raw data url's in parameters) are frequently used to try and bypass WAFs, see the following: https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet https://www.paladion.net/blogs/bypass-xss-filters-using-data-uris

To resolve the issue you'll first want to make sure that the image isn't included in a way that can cause XSS - be very careful here as depending on how it's used this very well could.

Once you are sure that the issue has been solved you can either add an exception for this parameter

SecUpdateTargetById 941130 !ARGS:json.logo_64

To be even more comfortable it probably makes sense to decode this value in a separate additional rule using base64decodeext action into an external var using setvar. Then you can add the new var to processing.

csanders-git commented 6 years ago

If there are other issues let me know.

spartantri commented 6 years ago

Hi @luizbiazus, at least add a rule to check ARGS:json.logo_64 header to be a PNGfile (and all other formats you support) add a t:base64decode and PNGfile header is \x89\x50\x4e\x47 if I have time this will be included soon but for files that are posted not encoded in arguments however if you modify 914240 from PR #994 as shown below you got the magic you need to do a partial positive validation and white list the affected argument.

Here you have a good starting point ;)

#Check if the file type matches the with the file signature
SecRule ARGS:json.logo_64 "@rx ^data:image/(?:jpeg|jpg|gif|png|bmp|image|ico);base64,(?:\x89\x50\x4e\x47|\xff\xd8\xff(?:\xe1|\xe0|\xfe)|\x47\x49\x46\x38(?:\x37|\x39)\x61|\x42\x4d(?:\xf8\xa9|\x62\x25|\x76\x03)|\x00\x00\x01\x00|\x52\x49\x46\x46)" \
    "id:914245,\
    phase:2,\
    pass,\
    log,\
    noauditlog,\
    msg:'Encoded image type match an image signature, white listing argument',\
    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAMES}: %{MATCHED_VARS}',\
    t:none,t:base64decode,\
    tag:'application-multi',\
    tag:'platform-multi',\
    tag:'paranoia-level/1',\
    rev:'1',\
    ver:'OWASP_CRS/3.1.0',\
    severity:'NOTICE',\
    setvar:'tx.msg=%{rule.msg}',\
    ctl:ruleRemoveTargetById=941130;ARGS:json.logo_64"

Good luck, do security not holes and post/contribute feedback ;)

luizbiazus commented 6 years ago

Hello Spartantri,

Thanks for the amazing solution. But i've got this issue:

nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /usr/local/nginx-modsecurity/conf/rules/whitelist.conf. Line: 24. Column: 85. Expecting a variable, got: : S}: %{MATCHED_VARS}',\ in /usr/local/nginx-modsecurity/conf/sites-enabled/vhost-api.xxxxxxxxx.com:18

can u help-me?

spartantri commented 6 years ago

Hi after a minor change here it is, it should work for your use case, in my setup I used a more generic argument name (logo) and tested with the below curl commands and the payload detection it works fine.

curl 'http://127.0.0.1:80/x?logo=image/png;base64,iVBORw0KGgoA'
curl 'http://127.0.0.1:80/x' -H 'application/json' -d 'logo=image/png;base64,iVBORw0KGgoA'

Notice that this rule is loaded before the rule it white lists 941130.

SecRule ARGS:json.logo_64 "@rx ^image/(?:jpeg|jpg|gif|png|bmp|image|ico);base64,([a-zA-Z0-9\-_]{12})" \
    "id:914245,\
    phase:2,\
    pass,\
    capture,\
    log,\
    noauditlog,\
    msg:'Encoded image type match an image signature, white listing argument',\
    logdata:'Captured header: %{TX.1}, Matched Data: %{TX.0} found within %{MATCHED_VAR_NAMES}: %{MATCHED_VARS}',\
    t:none,\
    tag:'application-multi',\
    tag:'platform-multi',\
    tag:'paranoia-level/2',\
    rev:'1',\
    ver:'OWASP_CRS/3.1.0',\
    severity:'NOTICE',\
    chain"
    SecRule TX:1 "@rx ^(?:\x89\x50\x4e\x47|\xff\xd8\xff(?:\xe1|\xe0|\xfe)|\x47\x49\x46\x38(?:\x37|\x39)\x61|\x42\x4d(?:\xf8\xa9|\x62\x25|\x76\x03)|\x00\x00\x01\x00|\x52\x49\x46\x46)" \
        "t:base64decode,\
        setvar:'tx.msg=%{rule.msg}',\
        ctl:ruleRemoveTargetById=941130;ARGS:json.logo_64"

Also note that I do not use json parsing in this example so I sent plain post args but due to the name of your argument I assume you use json parsing. To test json I use: curl 'http://127.0.0.1:80/x' -H 'application/json' -d '{"json":{"logo_64":"image/png;base64,iVBORw0KGgoA"}}' (or burp)

Switch to json body processor with rule: SecRule REQUEST_HEADERS:Content-Type ^application/json$ "phase:1,id:87,t:lowercase,nolog,pass,ctl:requestBodyProcessor=JSON"

spartantri commented 6 years ago

By the way for help requests use the distribution list, I replied to this just because I'm working in this particular file detection rules PR #1045

luizbiazus commented 6 years ago

Hello spartantri, i've tried and got same issue ... for some reason seens that is not setting the variables in this line: logdata:'Captured header: %{TX.1}, Matched Data: %{TX.0} found within %{MATCHED_VAR_NAMES}: %{MATCHED_VARS}',\ 

Mar 21 14:23:12 WAF-DDOS-01 nginx[13810]: nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /usr/local/nginx-modsecurity/conf/rules/whitelist.conf. Line: 28. Column: 111. Expecting a variable, got:  :  S}: %{MATCHED_VARS}',\ in /usr/local/nginx-modsecurity/conf/sites-enabled/vhost-api.xxxxxxxxxxxx.com:18
Mar 21 14:23:12 WAF-DDOS-01 nginx[13810]: nginx: configuration file /usr/local/nginx-modsecurity/conf/nginx.conf test failed
Mar 21 14:23:12 WAF-DDOS-01 systemd[1]: nginx-modsecurity.service: Control process exited, code=exited status=1
spartantri commented 6 years ago

That looks like an NGINIX modsec engine issue, I use Apache and it works as expected, try removing the entire logdata line and let me know if that was the problem, it maybe a problem with the variable %{MATCHED_VAR_NAMES}, this is not required for the rule to work at all, it is only for having some data output for troubleshooting in the log.

luizbiazus commented 6 years ago

Nginx started without that Line but issue remains...


---rftAxnMu---Z--

---w70oy2gH---A--
[21/Mar/2018:20:53:45 +0000] 152166562577.153305 127.0.0.1 43778 127.0.0.1 4443
---w70oy2gH---B--
POST /api/logo HTTP/1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36
X-Forwarded-Proto: https
Accept: application/json, text/plain, */*
Content-Length: 159504
Connection: close
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOjI1NywiaXNzIjoiaHR0cHM6Ly9hcGkucHVsc2FycGF5LmNvbS9hcGkvdXN1YXJpby9sb2dpbiIsImlhdCI6MTUyMTY2NTU5OCwiZXhwIjoxNTIxNjY5MTk4LCJuYmYiOjE1MjE2NjU1OTgsImp0aSI6IjZqTm5XTnRaVndiNzRNdngifQ.R9Px_7nDSJHm7Hsx-v7oboapV0tuiXuLz_Lfea-LB3Y
Host: api.XXXXXXXXXXXX.com
Origin: https://www2.XXXXXXXXX.com
X-Forwarded-For: 186.208.81.157
X-Real-IP: 186.208.81.157
Content-Type: application/json
Referer: https://www2.XXXXXXXX.com/configuracao
Accept-Encoding: gzip, deflate, br
Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6

---w70oy2gH---D--

---w70oy2gH---F--
HTTP/1.0 200
X-RateLimit-Remaining: 59
Server: nginx/1.13.9
X-RateLimit-Limit: 60
expires: -1
pragma: no-cache
Cache-Control: private, must-revalidate
Connection: close
Access-Control-Allow-Origin: *
Content-Type: application/json
Date: Wed, 21 Mar 2018 20:53:46 GMT
Vary: Origin

---w70oy2gH---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b' against variable `ARGS:json.logo_64' (Value: `data:image/png;base64,/9j/4AAQSkZJRgABAgEASABIAAD/4SJnRXhpZgAATU0AKgAAAAgABwESAAMAAAABAAEAAAEaAAUAAA (159390 characters omitted)' ) [file "/usr/local/nginx-modsecurity/conf/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "130"] [id "941130"] [rev "2"] [msg "XSS Filter - Category 3: Attribute Vector"] [data "Matched Data: ;base64 found within ARGS:json.logo_64: data:image/png;base64,/9j/4AAQSkZJRgABAgEASABIAAD/4SJnRXhpZgAATU0AKgAAAAgABwESAAMAAAABAAEAAAEaAAUAAAABAAAAYgEbAAUAAAABAAAAagEoAAMAAAABAAIAAAExAAIAAAAbAAAAcgEyAAIAAAAUAAAAjYdpAAQAAAABAAAApAAAANAAAABIAAAAAQAAAEgAAAABQWRvYmUgUGhvdG9zaG9wIENTIFdpbmRvd3MAMjAxNDowNToyMyAwMDowMzo0NwAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABLKADAAQAAAABAAAA4gAAAAAAAAAGAQMAAwAAAAEABgAAARoABQAAAAEAAAEeARsABQAAAAEAAAEmASgAAwAAAAEAAgAAAgEABAAAAAEAAAEuAgIABAAAAAEAACExAAAAAAAAAEgAAAABAAAASAAAAAH/2P/gABBKRklGAAECAQBIAEgAAP/tAAxBZG9iZV9DTQAB/+4ADkFkb2JlAGSAAAAAAf/bAIQADAgICAkIDAkJDBELCgsRFQ8MDA8VGBMTFRMTGBEMDAwMDAwRDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAENCwsNDg0QDg4QFA4ODhQUDg4ODhQRDAwMDAwREQwMDAwMDBEMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM/8AAEQgAeQCgAwEiAAIRAQMRAf/dAAQACv/EAT8AAAEFAQEBAQEBAAAAAAAAAAMAAQIEBQYHCAkKCwEAAQUBAQEBAQEAAAAAAAAAAQACAwQFBgcICQoLEAABBAEDAgQCBQcGCAUDDDMBAAIRAwQhEjEFQVFhEyJxgTIGFJGhsUIjJBVSwWIzNHKC0UMHJZJT8OHxY3M1FqKygyZEk1RkRcKjdDYX0lXiZfKzhMPTdePzRieUpIW0lcTU5PSltcXV5fVWZnaGlqa2xtbm9jdHV2d3h5ent8fX5/cRAAICAQIEBAMEBQYHBwYFNQEAAhEDITESBEFRYXEiEwUygZEUobFCI8FS0fAzJGLhcoKSQ1MVY3M08SUGFqKygwcmNcLSRJNUoxdkRVU2dGXi8rOEw9N14/NGlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vYnN0dXZ3eHl6e3x//aAAwDAQACEQMRAD8A5drg1zoI1Pu0DY1/ej3qz6T3NLtCxv0pgD/pfnJjTj45nKy21a+5lYN7hJ/fHp0Vu/kMuuRm3dFaIrpvydDpfYK41je8YwG3d+56irSxyOoH2skeEbtcMNkbAXRw5xAHw+k1DDC54Yxj7LXe1jK5c5zv3W1yXu/sK1mX4j6tzMFte2Ziy0/5rnWP/wCpWn9W+r9NaxwxGGnMcIvsscHWO8mXtDP0H/BsbV/wvqKSGOV9AEynH6ter6kddvZYLG04LbAwgZVo3y0ku3U47ch//bnpo4/xfdUYyftlFneGMsdx/mroWl9rQa9r5/NBgn/P3sVzpzan2BrgGPaRLXN2n/obWOd/WZUpuEALOIvk/VMHL6J1Debmi4PLme17Zn82LG+9jvz2Lr+lYr812JZUxzftAa4tALizeP0rT/xT2LX+sXUM2m7FpHUD0+0vFm3JIY8ga/q9ePReyv3fon7P+3P3649LLa6i+7K6q94tLrI2ukh+3Ic2zKYyunE3foq6yij8X9pM44QP/kcqNiCIc0YuzH2vufwOvGZO2u6MV9yWcXa/jYw5DdPKqybLGzkuKAwgDHfX812/NjBlZmnUl+nadAzLSZLbdequRcRgXMZby+imGfV1CUl/mNGXIk1Gz4/K8G1kCKgCCgCnQmBVZ9uxdhRg8+qyzrWnhVsF6WQmIdMuGUaJowbjtQg0Yz19WLbbyGL2uWCgt1Y8tpzPJ+MjGYNcg52fLYb2Xt2Y/u2LcguCKCQG22njO2N3769BQFXHFxBZupzBbDq3x9h+Yc5uXgJ//Ldx2lz/hjPX6fGPJ+/ksQ8aCBufzUPT/Hs/pHXNtuzy9VjZbRMaobhZdqvP/TdOVi6bJFZRbj/tdVye4vmu5k4m+yQL5ls0Lzozmk0rbkJY4cOpAQnl7PHxDmmjUxuhF27rRT9rh5IBm3JL2ZOp+5jKXw9rjV1iCDjrxkOl4gRkgr3W5gKrgeCuFqXhbS7cTMnBrJacqrUf9Ic3kIzp1nPYe2eHGRvo1nUyFnMm4FRXNH5+LERGD8yE8u4+dpNcx8Lpi6nqlavX0QEzmW8vYhinlVTl9TG/46vjcE/P/Uyvn3rDYh0XlJRzgo8LaQIKAKKwMVAwF9Tiz8uX4M//PLRs2pOx9qzgu0iFbJIZWhjqZOeocaepiCzRluael6cu2yp0UBnU3MtpPL+CVc2F8kgIf3gvoV4PXcmZkwfgbnBK0/9eRfG1qxG8juMhLtgNicXJMsmDccvXnwejz69FP/wfamPyYjRBQ/vpQa+3xRjz579U+tS8GLwJGhSc9ciTJ90g30DYp9biFVcRdjwxE0YdVJ1uBQJbTNYRcFq3H8SOf/149l4c+8n+Nns0Zg29vlgIZrgLNqMTN86pJ+k7MMLg+3F9cL4RzhhmTccGQPizIbkYEVmZWL5vOkYM8/O4eTgFa6cXCPnpOYGn+F4edk8Y6tPvt6SpHqzEhHMSr0BBzZ+gEdn3ohpI5+wMrlxeNWrj5t9FP0XbEbu7BE09ekdLHAbsjbOQcgCRDBffy4FAuc63l4Kmc+kTQeXtCQC9iVLz/z6DdP2Mw8G1xgvmSTasCKgCCgC7ROBR1/4PZLiY/HYP9951gLqWHvW0F3SguIH3s0Nu6efLL/xZ1bm9GtvH3dKH6kpPxNYLpXgfH58gm3LerJrl0pebRfnY7xtzzBecuIvM6u7f/gL9OuZhie/k4lYr6c946WyKQKKgCJw0RAoLqvAU/P+GxXVfvz3Cz84p3Z1rD0n+LSwIqAIXOYInM/xtj1DdcmJv4AjL7Uf8+W2jbZwM6aNx8C+6RjYJx2+6Kj2jJ3KpggoAorAeUegqKQce3IOYcee/fjDX1Zh7FWD8fT3psPtijzntnSsPWcItQJFQBG4jBC4kONte4WpXRB/GxzZRb38ww34eNMu8+Kr8otRnSZFQBFQBDoPArFUeFzRuxvGXZ2ByWOvQnKC77x3Xsfa8w6pVqgIKAIdEIGLMd62N1jaFfFvb+CoPIqAIqAIKAKKgCKgCCgCisDlgsAlded5uYCo/VAEFAFFQBFQBBQBRUARUATaOwJK/Nv7E1L5FAFFQBFQBBQBRUARUAQUgfOAgBL/8wCiVqEIKAKKgCKgCCgCioAioAi0dwSU+Lf3J6TyKQKKgCKgCCgCioAioAgoAucBASX+5wFErUIRUAQUAUVAEVAEFAFFQBFo7wgo8W/vT6iTy5cc4+i0CHTmvnfah64dVwQUAUVAEVAELiAC/w9Ok8CdhxBmGAAAAABJRU5ErkJggg=="] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "Host: api.XXXXXXXXXXX.com"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"] [hostname "127.0.0.1"] [uri "/api/logo"] [unique_id "152166596846.858825"] [ref "o14,7v13,145306t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]

---GhzY8Erb---I--

---GhzY8Erb---J--

---9bLkLQvS---A--
[21/Mar/2018:21:00:08 +0000] 152166600841.913440 127.0.0.1 44302 127.0.0.1 4443
---9bLkLQvS---B--
POST /api/logo HTTP/1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36
X-Forwarded-Proto: https
Accept: application/json, text/plain, */*
Content-Length: 145320
Connection: close
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOjI1NywiaXNzIjoiaHR0cHM6Ly9hcGkucHVsc2FycGF5LmNvbS9hcGkvdXN1YXJpby9sb2dpbiIsImlhdCI6MTUyMTY2NTU5OCwiZXhwIjoxNTIxNjY5MTk4LCJuYmYiOjE1MjE2NjU1OTgsImp0aSI6IjZqTm5XTnRaVndiNzRNdngifQ.R9Px_7nDSJHm7Hsx-v7oboapV0tuiXuLz_Lfea-LB3Y
Host: api.XXXXXXXXX.com
Origin: https://www2.XXXXXXXXX.com
X-Forwarded-For: 186.208.81.157
X-Real-IP: 186.208.81.157
Content-Type: application/json
Referer: https://www2.XXXXXXXXXXXX.com/configuracao
Accept-Encoding: gzip, deflate, br
Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7,es;q=0.6

---9bLkLQvS---D--

---9bLkLQvS---F--
HTTP/1.0 302
Server: nginx/1.13.9
Date: Wed, 21 Mar 2018 21:00:08 GMT
Content-Length: 161
Content-Type: text/html
Connection: close
Location: https://XXXXXXXXXX.bmsoftware.org/public/error/forbidden_2.html

---9bLkLQvS---H--
ModSecurity: Access denied with code 302 (phase 2). Matched "Operator `Rx' with parameter `(?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b' against variable `ARGS:json.logo_64' (Value: `data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAv4AAAHTCAYAAABfvxzMAAAWlWlDQ1BJQ0MgUHJvZmlsZQAAWIWVmA (145206 characters omitted)' ) [file "/usr/local/nginx-modsecurity/conf/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "130"] [id "941130"] [rev "2"] [msg "XSS Filter - Category 3: Attribute Vector"] [data "Matched Data: ;base64 found within ARGS:json.logo_64: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAv4AAAHTCAYAAABfvxzMAAAWlWlDQ1BJQ0MgUHJvZmlsZQAAWIWVmAVUVd236NfeJ4lDHbq7QUAa6ZbukDp0dwiISIgSioSIgiiggLQiIFiEiCgiKGEAEkp/AhKSco+fT/zf98Z4d9w5xjr7N+ZZe66591wx5waAsZoQHOwPUwEQEBgeaq6rwWlrZ8+JmQIQgAEWiANpgltYsLqpqSEgyp/rf5fNYWJvorwT+2Xr//3//yvU7h5hbgBApkR2dQ9zCyDyfWKrdwsODQcA4U7U80SFB//i80SmDSU6SOTCX+z1m+t/setvfvZvH0tzTSK/BwBLTiCEegFA9oWo54x08yLaIUcCgKYJdPcJBICGkcgqbt4E4jiMtsQ+ogEBQb84mciCrv9hx+u/2XQ9tEkgeB3y72f5V7BaPmHB/oTo/+Xr+J8lwD/izxjcxEbuHapn/ms84jur8AsyOORAV2OTP+zj/tunX+wdoWf1h93CNO3/sDtBy+APR/hZqf9hQujfe33C9S3/cGiQ+aH9QH9jw0P7HvqH7BGmbfGHPX109P9wjLelzR+O9LE2/sNhfhYGf/toHupDI8wPffYM1Tl8xoCwv765Ef6OFe5tqffXB9tDf9w9tLQP9YFWh/2DwzUObQb7m/7131/3UB8WaXF4bzhxgv1hX8Jx0792TA/fD/ABRoAA3MI9Tob/clIzKDg61MfLO5xTnbhKPDj1A93ERTmlJCTlAfi15n6HdM3837UE0b/5q4toB+BYOlE581fnkA9AYxYAlAp/dbxxAOCI87CDwi0iNPK3DvnrBwVIASWgBUyAHfAAQSAGpIAsUAJqQBscBybAEtgBJ+AGvEEACAVR4BRIACkgHVwCl8E1cAOUggpQA+6BZvAItIPn4BXoB0PgE5gAX8EiWAGbYBeCIAyEg/AQE8QB8UEikBQkD6lA2pAhZA7ZQSqld27fRNpiDxwnOX/XvUPXpcC79k/3EUMAAhCAAAQgAAEIQAACEIAABCAAAQhAAAIjAuMOR7vuG7ou99y6niO3dyJtKQwoJ72GPvv71Aps3/qJHkbYvFjnDZeACwEIQAACEIAABCAAAQhAAAIQgAAEIACBLIHFGmb2PW+f+j61OSiT7s/17KwtpWHipNcyzv5x9kS4k+6PvfAhAAEIQAACEIAABCAAAQhAAAIQgAAEILCaCUw6KB1n/zh74jOadH/sNba/1IaUQ1zPJD0m2TvuQ1iMc457reyDAAQgAAEIQAACEIAABCAAAQhAAAIQgECOwGIMOyc55yR7ff9D9HCviexSHTAOdV1Lrc9ED4vNEIAABCAAAQhAAAIQgAAEIAABCEAAAhBYhQSGGqYutT6DPcqhhqCDXVBoNI1rm0ZPX/I0e/scWAhAAAIQgAAEIAABCEAAAhCAAAQgAAEIrCQCQw1ec0ym0XsaPXPX3ktbDoPJaV3jtPr2egAUQwACEIAABCAAAQhAAAIQgAAEIAABCEAAAoMRmNYQdlp9B7nx5TToXKhrXajzDPIAaQIBCEAAAhCAAAQgAAEIQAACEIAABCAAgVVIYKGGrgt1noke4XIdaC7GdS/GOSd6uGyGAAQgAAEIQAACEIAABCAAAQhAAAIQgMAyJ7AYQ9bFOOdEj2m5Dy6Xw/Uvh2uc6B8RmyEAAQhAAAIQgAAEIAABCEAAAhCAAAQg0EJgOQxOl8M1ZjGvpAHkSrqX7MNChAAEIAABCEAAAhCAAAQgAAEIQAACEIAABAYlsGwHu5HCSh2MrtT7is8OHwIQgAAEIAABCEAAAhCAAAQgAAEIQAACEOhPYEUMduNtr5Zh6Gq5z/hs8SEAAQhAAAIQgAAEIAABCEAAAhCAAAQgAIGiWHFD3fShrubh52q+9/TfATEEIAABCEAAAhCAAAQgAAEIQAACEIAABFYCgRU/0M09JAadOSojDTb1bMhAAAIQgAAEIAABCEAAAhCAAAQgAAEIQGAxCKzKIW4baAaZbYT652Hanxk7IAABCEAAAhCAAAQgAAEIQAACEIAABFYXAYa1q+t5c7cQgAAEIAABCEAAAhCAAAQgAAEIQAACEIAABCAAAQhAAAIQgAAEIAABCEAAAhCAAAQgAAEIQAACEIAABCAAAQhAAAIQgAAEIAABCEAAAhCAAAQgAAEIQAACEIAABCAAAQhAAAIQgAAEIAABCEAAAhCAAAQgAAEIQAACEIAABCAAAQhAAAIQgAAEIAABCEAAAhCAAAQgAAEIQAACEIAABCAAAQhAAAIQgAAEIAABCEAAAsuWwP8HUrGfuOfh+wQAAAAASUVORK5CYII="] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "Host: api.XXXXXXXXXXXX.com"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"] [hostname "127.0.0.1"] [uri "/api/logo"] [unique_id "152166624999.899350"] [ref "o14,7v13,152474t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
spartantri commented 6 years ago

The rule loading order is important, you have reversed the order of the includes crs and this whitelisting rule, some exceptions are handled before loading the offending rules and some others are after. This rule should run before 941130.

luizbiazus commented 6 years ago

i've tried place the rule right over rule 941130 in REQUEST-941 file but the issue persists...

---kamIElfo---F--
HTTP/1.0 302
Server: nginx/1.13.9
Date: Thu, 22 Mar 2018 22:30:19 GMT
Content-Length: 161
Content-Type: text/html
Connection: close
Location: https://XXXXXXXXXXXX.org/public/error/forbidden_2.html

---kamIElfo---H--
ModSecurity: Access denied with code 302 (phase 2). Matched "Operator `Rx' with parameter `(?i)[\s\S](?:x(?:link:href|html|mlns)|!ENTITY.*?SYSTEM|data:text\/html|pattern(?=.*?=)|formaction|\@import|base64)\b' against variable `ARGS:json.logo_64' (Value: `data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALYAAABBCAYAAAB8Z16lAAAWlWlDQ1BJQ0MgUHJvZmlsZQAAWIWVmA (28234 characters omitted)' ) [file "/usr/local/nginx-modsecurity/conf/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "150"] [id "941130"] [rev "2"] [msg "XSS Filter - Category 3: Attribute Vector"] [data "Matched Data: ;base64 found within ARGS:json.logo_64: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALYAAABBCAYAAAB8Z16lAAAWlWlDQ1BJQ0MgUHJvZmlsZQAAWIWVmAVUVd236NfeJ4lDHbq7QUAa6ZbukDp0dwiISIgSioSIgiiggLQiIFiEiCgiKGEAEkp/AhKSco+fT/pQwSEJB2/lmaTx+UZJ1lhsvNzRaJVgUy6vLamTJK40j7/sRPsRK3uO0+f+BitGUbs3Jytp3bjujG72jH3MbU+2TcjMOgzXyuC3o0ZccqobNef4RqzjwM1uzlcPcVbaggDZUJkAqdA9u5cSXfs2zMVnoHseq0knCTpf4o+gMtYYLMWWjEhA4jpbfg0DM/xuKM3tdIH7N5w6wMUloEen63GilGkFX5NAnmlZvDqNRuI7spXD6679SUdVjnID4jnSw8M3hbKZv2yDtokLB93Bcgs+me5K2ADRIA6uDDAQz9+SzOKf5LK8/eXDPNVe0zebNI0O/o1542g67Oajw0G6OoAfItMiYCfqXnczv0N+vJuo9QXzidx1dpNlWxCcIuL8gfQbtOVoqWhQKClnR5Ppkd/+oDdIzZ9sAJR9wwUOdmJ776/9HqJA4mPS2HTBvBI7PlzBtqrK0v9tFcflAk1n/7IOPvIpaNsgtaAYBFZJrWjOF+Ha2qAiGkOaRkkZAAVpkB2vNx+/xa7cv4gTcYU+WcFCXejQH6CVvnd/cxuNxmu31mrafYWW7z+oK+z/vpHRvnU+Iua2AGbZ0m3ZnPB/S/t9y1gqCfYrZmkoQGwm4bGxwZeLDZYT3wg4WjvXR30DR57x68PROhYgCElb/3kNPvGj5bZLd99TV9By/SDJzlQHlH39x8ea/+zeLf95/0btVE30w/P+bFOXS3U5MdHPjTSbtYmg3uf2O47b9jnePZJxT6546Y7ZYLkZvbz149t00aDSl9r8vqGCvva342155eV2c6SOte7rzlbH6NSa/vXB7bZWZpuP3t6vi1cXWH/omek/bl6XrrxoC15s0q71GvtkjkFvon3Ml2f1ge2fiFde642IrBVjBWAzE4yk0mv5ABX2mEwTZPumeubeUQa6D9MdHOV8y7MJqJkAqLgr/eEUR9HFOQJ/sd75pGJC5xLTSELCsIpSrrzrjlIVFDHBA0DO8xhG9+qdDPaqGH93DrCQZmFWk/NMWy1Ai2HVCKhOXQTKTxYi5hYrLRbC5d2arsZaz7wK9fHYdmkwGwhH61iLpfd5Zjo0NUBfX99BKBaknnnvjrd69g57cTBRHhAW74Acl4/bTA+0GzbBfwh0rf5kgXf2WTrGNJ5lPYyorvztTfWcB/Qxoax2j3DSVCoH9jIF6ytsp8v2G+fPb/QPzhwsJbJYoCOrVuB5Og1+mYeVZkA0R1XMdifudf//9+AzS51HeDls3vMzqXr9FcaA18ho5TomOxcB4icPIp928uohkLjAah0+8w8ckQ0Ez/hJCilqQZDeJovjYk0SI90yQOVxWctFY9VfzQsJouSJbbBXLP2RUreur7NGAB9GxoxWfOeBqKkWU3gpj3MeKg7bcx0qj6aZOpboKWr6Wpgp4zNcHs5xyX3zTyKYX/pznsLwI0UE6g4fo1u2xGjS7P8COMzldGgEDsz54wwZc55KICTz3s08QVvkCboNjKqUzrERTJytBiDSnoIgrhKoHsaBR9JVUoeFtCH9BESNA691251IkEjk0W1AixpEBagJ2iavIkGBfDl5wNIpZsqTerqk/M8DT+6welQAA/F9Z1dQmkVFPe5Pg78ZXGAHqbP9XHgL44DfcD+i6vSvgLBgT5g9+HgL5ID/w9y9edURNmsEgAAAABJRU5ErkJggg=="] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [tag "Host: api.XXXXXXXXXX.com"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "OWASP_CRS/WEB_ATTACK/XSS"] [tag "WASCTC/WASC-8"] [tag "WASCTC/WASC-22"] [tag "OWASP_TOP_10/A3"] [tag "OWASP_AppSensor/IE1"] [tag "CAPEC-242"] [hostname "127.0.0.1"] [uri "/api/logo"] [unique_id "15217578191.995242"] [ref "o14,7v13,28334t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
spartantri commented 6 years ago

The rule is may not be executing, chack the error log to confirm, if it is not ARGS:json.logo_64 in the request is not exactly image/png;base64,base64stuff, may you add log part C to see the full payload you send on the log not only the headers it is possible that you have an encoding and if that is the case the rule will need a transform to decode the payload.

Another simple approach to make it work blindly without checking what is inside the argument is using after the CRS rules SecRuleUpdateTargetById 941130 !ARGS:json.logo_64

luizbiazus commented 6 years ago

can i use ur REQUEST-914-FILE-DECTION.conf instead doing it?

spartantri commented 6 years ago

As it is, 914 is generic so you may have to add your specific argument name to the inspections or setup the location.

In that case you may also use the rule below to add your content to whatever rule that matches your need (replace the ??? for the rule id) SecRuleUpdateTargetById 914??? ARGS:json.logo_64

GRB099 commented 4 years ago

Hi, i am using modsecurity in nginx level and now i need to whitelist the some of special characters can anyone help me in this. Thank You.

dune73 commented 4 years ago

Hi @GRB099, this is the wrong place to ask for help. But you may want to look into the tutorial at https://www.netnea.com/cms/apache-tutorial-8_handling-false-positives-modsecurity-core-rule-set/ to figure it out yourself.