Closed YeapGuy closed 3 months ago
@YeapGuy Have you tried using the Nextcloud rule exclusions plugin? The plugin should cover most false positives that you encounter with Nextcloud.
Yes, I am using that
Oh, I just realised... it has its own repository 😄 Should I report there instead?
I can transfer the issue if you want, then I'll take a look at the issue in a few hours.
@YeapGuy I just noticed that the log you've provided is incomplete, it only shows the anomoly scoring rule and not the rules that led to an anomoly score of 5. ModSecurity on Nginx doesn't log the rules that led to an anomoly score of 5 by default to the error log. you'll have to either enable info level error logging in nginx or search your modsecurity audit log (usually /var/log/modsec_audit.log) using this ID 171045623486.423063
.
@YeapGuy could you give this PR a try https://github.com/coreruleset/nextcloud-rule-exclusions-plugin/pull/66? I didn't encounter the specific false positive you reported, so I can't guarantee that issue is fixed unless you provide me with more detailed logging or more detailed steps to reproduce.
I don't use an iPhone myself, so I can't verify it myself, but so far, it seems to work. Thank you! If it doesn't work, I'll search for the relevant modsec audit log entry as well, of course.
Found it. It's due to content-type. Calendar invitations use text/calendar
(rfc)
@YeapGuy Thanks, I've pushed another commit.
Description
An iPhone trying to PUT to Nextcloud's calDAV service will be blocked by CRS.
Logs
Your Environment
Confirmation
[ ] I have removed any personal data (email addresses, IP addresses, passwords, domain names) from any logs posted.