mirror of
https://github.com/alibaba/higress.git
synced 2026-03-04 08:30:48 +08:00
1038 lines
48 KiB
Plaintext
1038 lines
48 KiB
Plaintext
# ------------------------------------------------------------------------
|
|
# OWASP ModSecurity Core Rule Set ver.4.0.0-rc1
|
|
# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
|
|
# Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
|
|
#
|
|
# The OWASP ModSecurity Core Rule Set is distributed under
|
|
# Apache Software License (ASL) version 2
|
|
# Please see the enclosed LICENSE file for full details.
|
|
# ------------------------------------------------------------------------
|
|
|
|
#
|
|
# -= Paranoia Level 0 (empty) =- (apply unconditionally)
|
|
#
|
|
|
|
|
|
|
|
SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:941011,phase:1,pass,nolog,skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS"
|
|
SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:941012,phase:2,pass,nolog,skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS"
|
|
#
|
|
# -= Paranoia Level 1 (default) =- (apply only when tx.detection_paranoia_level is sufficiently high: 1 or higher)
|
|
#
|
|
|
|
|
|
# In CRS v4.0, we have added REQUEST_FILENAME to the list of variables to
|
|
# be checked for XSS to catch path-based XSS exploits such as:
|
|
# /index.php/%3Csvg/onload=alert()
|
|
#
|
|
# However, the REQUEST_FILENAME is always populated (while ARGS etc. are
|
|
# only set on some requests) and we found that always checking the
|
|
# REQUEST_FILENAME has a significant performance impact.
|
|
# Therefore, we are disabling the REQUEST_FILENAME XSS checks when the
|
|
# REQUEST_FILENAME is clearly not containing special characters necessary
|
|
# for a successful XSS.
|
|
#
|
|
# Some bona-fide REQUEST_FILENAMEs will still contain special characters
|
|
# and will be checked by the rules, but it will be a much lower amount,
|
|
# and that is a trade-off we are willing to make.
|
|
#
|
|
# So, we check for XSS in REQUEST_FILENAME only if it contains
|
|
# other characters than alphanumeric characters, hyphens, underscores etc.
|
|
# typically found in filenames and paths:
|
|
#
|
|
# - ascii 20 (whitespace)
|
|
# - ascii 45-47 (- . /)
|
|
# - ascii 48-57 (0-9)
|
|
# - ascii 65-90 (A-Z)
|
|
# - ascii 95 (underscore)
|
|
# - ascii 97-122 (a-z)
|
|
#
|
|
# If just these characters are present, we remove REQUEST_FILENAME from the target
|
|
# list of all the 941xxx rules starting 941100.
|
|
#
|
|
# Please note that it would be preferable to start without REQUEST_FILENAME in the
|
|
# target list and to add it on a case to case base, but the rule language does not
|
|
# support this feature at runtime.
|
|
#
|
|
SecRule REQUEST_FILENAME "!@validateByteRange 20, 45-47, 48-57, 65-90, 95, 97-122" \
|
|
"id:941010,\
|
|
phase:1,\
|
|
pass,\
|
|
t:none,\
|
|
nolog,\
|
|
ctl:ruleRemoveTargetById=941100-941999;REQUEST_FILENAME"
|
|
|
|
|
|
#
|
|
# -=[ Libinjection - XSS Detection ]=-
|
|
#
|
|
# Ref: https://github.com/client9/libinjection
|
|
# Ref: https://speakerdeck.com/ngalbreath/libinjection-from-sqli-to-xss
|
|
#
|
|
# -=[ Targets ]=-
|
|
#
|
|
# 941100: PL1 : REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|
|
|
# REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|
|
|
# ARGS_NAMES|ARGS|XML:/*
|
|
#
|
|
# 941101: PL2 : REQUEST_FILENAME|REQUEST_HEADERS:Referer
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/* "@detectXSS" \
|
|
"id:941100,\
|
|
phase:2,\
|
|
block,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'XSS Attack Detected via libinjection',\
|
|
logdata:'Matched Data: XSS data found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
#
|
|
# -=[ XSS Filters - Category 1 ]=-
|
|
# http://xssplayground.net23.net/xssfilter.html
|
|
# script tag based XSS vectors, e.g., <script> alert(1)</script>
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_FILENAME|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@rx (?i)<script[^>]*>[\s\S]*?" \
|
|
"id:941110,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'XSS Filter - Category 1: Script Tag Vector',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
#
|
|
# -=[ XSS Filters - Category 3 ]=-
|
|
#
|
|
# Regular expression generated from regex-assembly/941130.ra.
|
|
# To update the regular expression run the following shell script
|
|
# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
|
|
# crs-toolchain regex update 941130
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i).(?:\b(?:x(?:link:href|html|mlns)|data:text/html|formaction|pattern\b.*?=)|!ENTITY[\s\v]+(?:%[\s\v]+)?[^\s\v]+[\s\v]+(?:SYSTEM|PUBLIC)|@import|;base64)\b" \
|
|
"id:941130,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'XSS Filter - Category 3: Attribute Vector',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
#
|
|
# -=[ XSS Filters - Category 4 ]=-
|
|
# XSS vectors making use of javascript uri and tags, e.g., <p style="background:url(javascript:alert(1))">
|
|
# https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#css-expressions-ie7
|
|
# https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#behaviors-for-older-modes-of-ie
|
|
# examples: https://regex101.com/r/FFEpsh/1
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)[a-z]+=(?:[^:=]+:.+;)*?[^:=]+:url\(javascript" \
|
|
"id:941140,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,t:removeWhitespace,\
|
|
msg:'XSS Filter - Category 4: Javascript URI Vector',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
#
|
|
# -=[ NoScript XSS Filters ]=-
|
|
# Ref: http://noscript.net/
|
|
#
|
|
# [NoScript InjectionChecker] HTML injection
|
|
#
|
|
# Regular expression generated from regex-assembly/941160.ra.
|
|
# To update the regular expression run the following shell script
|
|
# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
|
|
# crs-toolchain regex update 941160
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)<[^0-9<>A-Z_a-z]*(?:[^\s\v\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e|v[^0-9A-Z_a-z]*?g|e[^0-9A-Z_a-z]*?t[^0-9>A-Z_a-z])|f[^0-9A-Z_a-z]*?o[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?m|m[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?q[^0-9A-Z_a-z]*?u[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?e|e[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?a[^0-9>A-Z_a-z])|(?:l[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?k|o[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?j[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?c[^0-9A-Z_a-z]*?t|e[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?b[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?d|a[^0-9A-Z_a-z]*?(?:p[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?l[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?t|u[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?o|n[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?t[^0-9A-Z_a-z]*?e)|p[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m|i?[^0-9A-Z_a-z]*?f[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?a[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?e|b[^0-9A-Z_a-z]*?(?:a[^0-9A-Z_a-z]*?s[^0-9A-Z_a-z]*?e|o[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?y|i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?n[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?s)|i[^0-9A-Z_a-z]*?m[^0-9A-Z_a-z]*?a?[^0-9A-Z_a-z]*?g[^0-9A-Z_a-z]*?e?|v[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?d[^0-9A-Z_a-z]*?e[^0-9A-Z_a-z]*?o)[^0-9>A-Z_a-z])|(?:<[0-9A-Z_a-z].*[\s\v/]|[\"'](?:.*[\s\v/])?)(?:background|formaction|lowsrc|on(?:a(?:bort|ctivate|d(?:apteradded|dtrack)|fter(?:print|(?:scriptexecu|upda)te)|lerting|n(?:imation(?:end|iteration|start)|tennastatechange)|ppcommand|udio(?:end|process|start))|b(?:e(?:fore(?:(?:(?:de)?activa|scriptexecu)te|c(?:opy|ut)|editfocus|p(?:aste|rint)|u(?:nload|pdate))|gin(?:Event)?)|l(?:ocked|ur)|oun(?:ce|dary)|roadcast|usy)|c(?:a(?:(?:ch|llschang)ed|nplay(?:through)?|rdstatechange)|(?:ell|fstate)change|h(?:a(?:rging(?:time)?cha)?nge|ecking)|l(?:ick|ose)|o(?:m(?:mand(?:update)?|p(?:lete|osition(?:end|start|update)))|n(?:nect(?:ed|ing)|t(?:extmenu|rolselect))|py)|u(?:echange|t))|d(?:ata(?:(?:availabl|chang)e|error|setc(?:hanged|omplete))|blclick|e(?:activate|livery(?:error|success)|vice(?:found|light|(?:mo|orienta)tion|proximity))|i(?:aling|s(?:abled|c(?:hargingtimechange|onnect(?:ed|ing))))|o(?:m(?:a(?:ctivate|ttrmodified)|(?:characterdata|subtree)modified|focus(?:in|out)|mousescroll|node(?:inserted(?:intodocument)?|removed(?:fromdocument)?))|wnloading)|r(?:ag(?:drop|e(?:n(?:d|ter)|xit)|(?:gestur|leav)e|over|start)|op)|urationchange)|e(?:mptied|n(?:abled|d(?:ed|Event)?|ter)|rror(?:update)?|xit)|f(?:ailed|i(?:lterchange|nish)|o(?:cus(?:in|out)?|rm(?:change|input)))|g(?:amepad(?:axismove|button(?:down|up)|(?:dis)?connected)|et)|h(?:ashchange|e(?:adphoneschange|l[dp])|olding)|i(?:cc(?:cardlockerror|infochange)|n(?:coming|put|valid))|key(?:down|press|up)|l(?:evelchange|o(?:ad(?:e(?:d(?:meta)?data|nd)|start)?|secapture)|y)|m(?:ark|essage|o(?:use(?:down|enter|(?:lea|mo)ve|o(?:ut|ver)|up|wheel)|ve(?:end|start)?|z(?:a(?:fterpaint|udioavailable)|(?:beforeresiz|orientationchang|t(?:apgestur|imechang))e|(?:edgeui(?:c(?:ancel|omplet)|start)e|network(?:down|up)loa)d|fullscreen(?:change|error)|m(?:agnifygesture(?:start|update)?|ouse(?:hittest|pixelscroll))|p(?:ointerlock(?:change|error)|resstapgesture)|rotategesture(?:start|update)?|s(?:crolledareachanged|wipegesture(?:end|start|update)?))))|no(?:match|update)|o(?:(?:bsolet|(?:ff|n)lin)e|pen|verflow(?:changed)?)|p(?:a(?:ge(?:hide|show)|int|(?:st|us)e)|lay(?:ing)?|op(?:state|up(?:hid(?:den|ing)|show(?:ing|n)))|ro(?:gress|pertychange))|r(?:atechange|e(?:adystatechange|ceived|movetrack|peat(?:Event)?|quest|s(?:et|ize|u(?:lt|m(?:e|ing)))|trieving)|ow(?:e(?:nter|xit)|s(?:delete|inserted)))|s(?:croll|e(?:ek(?:complete|ed|ing)|lect(?:start)?|n(?:ding|t)|t)|how|(?:ound|peech)(?:end|start)|t(?:a(?:lled|rt|t(?:echange|uschanged))|k(?:comma|sessione)nd|op)|u(?:bmit|ccess|spend)|vg(?:abort|error|(?:un)?load|resize|scroll|zoom))|t(?:ext|ime(?:out|update)|ouch(?:cancel|en(?:d|ter)|(?:lea|mo)ve|start)|ransition(?:cancel|end|run))|u(?:n(?:derflow|load)|p(?:dateready|gradeneeded)|s(?:erproximity|sdreceived))|v(?:ersion|o(?:ic|lum)e)change|w(?:a(?:it|rn)ing|heel)|zoom)|ping|s(?:rc|tyle))[\x08-\n\f-\r ]*?=" \
|
|
"id:941160,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'NoScript XSS InjectionChecker: HTML Injection',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
#
|
|
# [NoScript InjectionChecker] Attributes injection
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)(?:\W|^)(?:javascript:(?:[\s\S]+[=\x5c\(\[\.<]|[\s\S]*?(?:\bname\b|\x5c[ux]\d))|data:(?:(?:[a-z]\w+/\w[\w+-]+\w)?[;,]|[\s\S]*?;[\s\S]*?\b(?:base64|charset=)|[\s\S]*?,[\s\S]*?<[\s\S]*?\w[\s\S]*?>))|@\W*?i\W*?m\W*?p\W*?o\W*?r\W*?t\W*?(?:/\*[\s\S]*?)?(?:[\"']|\W*?u\W*?r\W*?l[\s\S]*?\()|[^-]*?-\W*?m\W*?o\W*?z\W*?-\W*?b\W*?i\W*?n\W*?d\W*?i\W*?n\W*?g[^:]*?:\W*?u\W*?r\W*?l[\s\S]*?\(" \
|
|
"id:941170,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'NoScript XSS InjectionChecker: Attribute Injection',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
#
|
|
# [Deny List Keywords from Node-Validator]
|
|
# https://raw.github.com/chriso/node-validator/master/validator.js
|
|
# This rule has a stricter sibling 941181 (PL2) that covers the additional payload "-->"
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@pm document.cookie document.domain document.write .parentnode .innerhtml window.location -moz-binding <!-- <![cdata[" \
|
|
"id:941180,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'Node-Validator Deny List Keywords',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
#
|
|
# -=[ XSS Filters from IE ]=-
|
|
# Ref: http://blogs.technet.com/srd/archive/2008/08/18/ie-8-xss-filter-architecture-implementation.aspx
|
|
# Ref: http://xss.cx/examples/ie/internet-exploror-ie9-xss-filter-rules-example-regexp-mshtmldll.txt
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i:<style.*?>.*?(?:@[i\x5c]|(?:[:=]|&#x?0*(?:58|3A|61|3D);?).*?(?:[(\x5c]|&#x?0*(?:40|28|92|5C);?)))" \
|
|
"id:941190,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i:<.*[:]?vmlframe.*?[\s/+]*?src[\s/+]*=)" \
|
|
"id:941200,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i:(?:j|&#x?0*(?:74|4A|106|6A);?)(?:\t|\n|\r|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:a|&#x?0*(?:65|41|97|61);?)(?:\t|\n|\r|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:v|&#x?0*(?:86|56|118|76);?)(?:\t|\n|\r|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:a|&#x?0*(?:65|41|97|61);?)(?:\t|\n|\r|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:s|&#x?0*(?:83|53|115|73);?)(?:\t|\n|\r|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:c|&#x?0*(?:67|43|99|63);?)(?:\t|\n|\r|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:r|&#x?0*(?:82|52|114|72);?)(?:\t|\n|\r|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:i|&#x?0*(?:73|49|105|69);?)(?:\t|\n|\r|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:p|&#x?0*(?:80|50|112|70);?)(?:\t|\n|\r|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:t|&#x?0*(?:84|54|116|74);?)(?:\t|\n|\r|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?::|&(?:#x?0*(?:58|3A);?|colon;)).)" \
|
|
"id:941210,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i:(?:v|&#x?0*(?:86|56|118|76);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:b|&#x?0*(?:66|42|98|62);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:s|&#x?0*(?:83|53|115|73);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:c|&#x?0*(?:67|43|99|63);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:r|&#x?0*(?:82|52|114|72);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:i|&#x?0*(?:73|49|105|69);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:p|&#x?0*(?:80|50|112|70);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?:t|&#x?0*(?:84|54|116|74);?)(?:\t|&(?:#x?0*(?:9|13|10|A|D);?|tab;|newline;))*(?::|&(?:#x?0*(?:58|3A);?|colon;)).)" \
|
|
"id:941220,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)<EMBED[\s/+].*?(?:src|type).*?=" \
|
|
"id:941230,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx <[?]?import[\s/+\S]*?implementation[\s/+]*?=" \
|
|
"id:941240,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:lowercase,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i:<META[\s/+].*?http-equiv[\s/+]*=[\s/+]*[\"'`]?(?:(?:c|&#x?0*(?:67|43|99|63);?)|(?:r|&#x?0*(?:82|52|114|72);?)|(?:s|&#x?0*(?:83|53|115|73);?)))" \
|
|
"id:941250,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i:<META[\s/+].*?charset[\s/+]*=)" \
|
|
"id:941260,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)<LINK[\s/+].*?href[\s/+]*=" \
|
|
"id:941270,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)<BASE[\s/+].*?href[\s/+]*=" \
|
|
"id:941280,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)<APPLET[\s/+>]" \
|
|
"id:941290,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)<OBJECT[\s/+].*?(?:type|codetype|classid|code|data)[\s/+]*=" \
|
|
"id:941300,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
#
|
|
# https://www.owasp.org/www-community/xss-filter-evasion-cheatsheet
|
|
# US-ASCII encoding bypass listed on XSS filter evasion
|
|
# Reported by Mazin Ahmed
|
|
#
|
|
# This evasion covered by this chain of rules is specific to webservers that deliver content in US-ASCII.
|
|
# Only Apache Tomcat is known (according to the page linked above) to be vulnerable to this and probably has to be
|
|
# misconfigured for this to happen.
|
|
#
|
|
# Since US-ASCII is a seven bit encoding, bit 8 is ignored. Consider the following ISO 8859-1 sequence:
|
|
#
|
|
# ¼script¾alert(¢XSS¢)¼/script¾
|
|
#
|
|
# A filter looking for tags will usually not match against this sequence because there are no angle brackets (< / >). However,
|
|
# the characters where the brackets would be are ISO 8859-1 characters:
|
|
# - ¼: 0x00BC
|
|
# - ¾: 0x00BE
|
|
# - ¢: 0x00A2
|
|
#
|
|
# And this is how the sequence looks in in US-ASCII:
|
|
#
|
|
# <script>alert("XSSB")</script/>
|
|
#
|
|
# This enables an attacker to craft a string that will be delivered in a form that a browser will execute as script
|
|
# while being ignored by input filters.
|
|
#
|
|
# This rule looks for start tag sequene that looks like "<...>" (checks fo hex and plain to be sure).
|
|
# Because the bytes matched occur in many different languages encoded as multibyte characters (e.g. UTF-8)
|
|
# (e.g. German umlauts, Russian characters) this isn't very helpful and can cause many false positives. We, therefore,
|
|
# use a chained rule to also look for an end tag sequence that looks like "</...>". Only if the chained rule matches will
|
|
# the request be blocked.
|
|
#
|
|
# This is of course still not perfect but should at least make it harder to hide most tags using this technique while
|
|
# requiring very specific patterns in a language to match, which should get rid of most false positives.
|
|
# These rules would, for example, not guard against an element without an end tag, e.g. "<img... />".
|
|
#
|
|
# US-ASCII on Wikipedia: https://en.wikipedia.org/wiki/ASCII
|
|
# ISO 8859-1 on Wikipedia: https://en.wikipedia.org/wiki/ISO/IEC_8859-1
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx \xbc[^\xbe>]*[\xbe>]|<[^\xbe]*\xbe" \
|
|
"id:941310,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:lowercase,t:urlDecode,t:htmlEntityDecode,t:jsDecode,\
|
|
msg:'US-ASCII Malformed Encoding XSS Filter - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-tomcat',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
chain"
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?:\xbc\s*/\s*[^\xbe>]*[\xbe>])|(?:<\s*/\s*[^\xbe]*\xbe)" \
|
|
"t:none,t:lowercase,t:urlDecode,t:htmlEntityDecode,t:jsDecode,\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
#
|
|
# https://nedbatchelder.com/blog/200704/xss_with_utf7.html
|
|
# UTF-7 encoding XSS filter evasion for IE.
|
|
# Reported by Vladimir Ivanov
|
|
#
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx \+ADw-.*(?:\+AD4-|>)|<.*\+AD4-" \
|
|
"id:941350,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:urlDecode,t:htmlEntityDecode,t:jsDecode,\
|
|
msg:'UTF-7 Encoding IE XSS - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-internet-explorer',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
#
|
|
# Defend against JSFuck and Hieroglyphy obfuscation of Javascript code
|
|
#
|
|
# https://en.wikipedia.org/wiki/JSFuck
|
|
# https://github.com/alcuadrado/hieroglyphy
|
|
#
|
|
# These JS obfuscations mostly aim for client side XSS exploits, hence the
|
|
# integration of this rule into the XSS rule group. But serverside JS could
|
|
# also be attacked via these techniques.
|
|
#
|
|
# Detection pattern / Core elements of JSFuck and Hieroglyphy are the
|
|
# following two items:
|
|
# !![]
|
|
# !+[]
|
|
#
|
|
# ModSecurity always transforms "+" into " " with query strings and the
|
|
# URLENCODE body processor (but not for JSON). So we need to check for
|
|
# the following patterns:
|
|
# !![]
|
|
# !+[]
|
|
# ! []
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx ![!+ ]\[\]" \
|
|
"id:941360,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,\
|
|
msg:'JSFuck / Hieroglyphy obfuscation detected',\
|
|
logdata:'Matched Data: Suspicious payload found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242/63',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
#
|
|
# Prevent 941180 bypass by using JavaScript global variables
|
|
# Refer to: https://www.secjuice.com/bypass-xss-filters-using-javascript-global-variables/
|
|
#
|
|
# Examples:
|
|
# - /?search=/?a=";+alert(self["document"]["cookie"]);//
|
|
# - /?search=/?a=";+document+/*foo*/+.+/*bar*/+cookie;//
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?:self|document|this|top|window)\s*(?:/\*|[\[)]).+?(?:\]|\*/)" \
|
|
"id:941370,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:urlDecodeUni,t:compressWhitespace,\
|
|
msg:'JavaScript global variable found',\
|
|
logdata:'Matched Data: Suspicious JS global variable found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242/63',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
#
|
|
# JavaScript methods which take code as a string types are considered unsafe.
|
|
# Unsafe JS functions like eval(), setInterval(), setTimeout()
|
|
# Unsafe JS constructor new Function()
|
|
# https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#dangerous-contexts
|
|
# https://snyk.io/blog/5-ways-to-prevent-code-injection-in-javascript-and-node-js/
|
|
#
|
|
# Regular expression generated from regex-assembly/941390.ra.
|
|
# To update the regular expression run the following shell script
|
|
# (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
|
|
# crs-toolchain regex update 941390
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)\b(?:eval|set(?:timeout|interval)|new[\s\v]+Function|a(?:lert|tob)|btoa)[\s\v]*\(" \
|
|
"id:941390,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:htmlEntityDecode,t:jsDecode,\
|
|
msg:'Javascript method detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
#
|
|
# JavaScript function without parentheses
|
|
# Reference: https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses
|
|
#
|
|
# Example Payloads:
|
|
# [].sort.call`${alert}1337`
|
|
# [].map.call`${eval}\\u{61}lert\x281337\x29`
|
|
# Reflect.apply.call`${navigation.navigate}${navigation}${[name]}`
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx ((?:\[[^\]]*\][^.]*\.)|Reflect[^.]*\.).*(?:map|sort|apply)[^.]*\..*call[^`]*`.*`" \
|
|
"id:941400,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:urlDecodeUni,t:compressWhitespace,\
|
|
msg:'XSS JavaScript function without parentheses',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/1',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:941013,phase:1,pass,nolog,skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS"
|
|
SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:941014,phase:2,pass,nolog,skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS"
|
|
#
|
|
# -= Paranoia Level 2 =- (apply only when tx.detection_paranoia_level is sufficiently high: 2 or higher)
|
|
#
|
|
|
|
#
|
|
# This is a stricter sibling of rule 941100.
|
|
#
|
|
SecRule REQUEST_FILENAME|REQUEST_HEADERS:Referer "@detectXSS" \
|
|
"id:941101,\
|
|
phase:1,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'XSS Attack Detected via libinjection',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
tag:'paranoia-level/2',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
#
|
|
# -=[ XSS Filters - Category 2 ]=-
|
|
# XSS vectors making use of event handlers like onerror, onload etc, e.g., <body onload="alert(1)">
|
|
#
|
|
# We are not listing all the known event handlers like rule 941160, but we
|
|
# limit the alerts to keywords of 3-25 characters after the prefix ("on").
|
|
#
|
|
# The shortest known event is "onget". The longest known event is "onmozorientationchange"
|
|
# with 23 chars after the prefix. 25 chars adds a little bit of safety.
|
|
#
|
|
# This rule has been moved to PL2 since it has a tendency to trigger on random input.
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)[\s\"'`;/0-9=\x0B\x09\x0C\x3B\x2C\x28\x3B]on[a-zA-Z]{3,25}[\s\x0B\x09\x0C\x3B\x2C\x28\x3B]*?=[^=]" \
|
|
"id:941120,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'XSS Filter - Category 2: Event Handler Vector',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/2',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
#
|
|
# -=[ XSS Filters - Category 5 ]=-
|
|
# HTML attributes - src, style and href
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=" \
|
|
"id:941150,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls,\
|
|
msg:'XSS Filter - Category 5: Disallowed HTML Attributes',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
tag:'paranoia-level/2',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
|
|
#
|
|
# [Deny List Keywords from Node-Validator]
|
|
# https://raw.github.com/chriso/node-validator/master/validator.js
|
|
# This rule is a stricter sibling of 941180 (PL1)
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@contains -->" \
|
|
"id:941181,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:lowercase,t:removeNulls,\
|
|
msg:'Node-Validator Deny List Keywords',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'paranoia-level/2',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
|
|
#
|
|
# -=[ XSS Filters from IE ]=-
|
|
|
|
# Detect tags that are the most common direct HTML injection points.
|
|
#
|
|
# <a href=javascript:...
|
|
# <applet src="..." type=text/html>
|
|
# <applet src="data:text/html;base64,PHNjcmlwdD5hbGVydCgvWFNTLyk8L3NjcmlwdD4" type=text/html>
|
|
# <base href=javascript:...
|
|
# <base href=... // change base URL to something else to exploit relative filename inclusion
|
|
# <bgsound src=javascript:...
|
|
# <body background=javascript:...
|
|
# <body onload=...
|
|
# <embed src=http://www.example.com/flash.swf allowScriptAccess=always
|
|
# <embed src="data:image/svg+xml;
|
|
# <frameset><frame src="javascript:..."></frameset>
|
|
# <iframe src=javascript:...
|
|
# <img src=x onerror=...
|
|
# <input type=image src=javascript:...
|
|
# <layer src=...
|
|
# <link href="javascript:..." rel="stylesheet" type="text/css"
|
|
# <link href="http://www.example.com/xss.css" rel="stylesheet" type="text/css"
|
|
# <meta http-equiv="refresh" content="0;url=javascript:..."
|
|
# <meta http-equiv="refresh" content="0;url=http://;javascript:..." // evasion
|
|
# <meta http-equiv="link" rel=stylesheet content="http://www.example.com/xss.css">
|
|
# <meta http-equiv="Set-Cookie" content="NEW_COOKIE_VALUE">
|
|
# <object data=http://www.example.com
|
|
# <object type=text/x-scriptlet data=...
|
|
# <object type=application/x-shockwave-flash data=xss.swf>
|
|
# <object classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:...></object> // not verified
|
|
# <script>...</script>
|
|
# <script src=http://www.example.com/xss.js></script> - TODO add another rule for this
|
|
# <script src="data:text/javascript,alert(1)"></script>
|
|
# <script src="data:text/javascript;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpOzwvc2NyaXB0Pg=="></script>
|
|
# <style>STYLE</style>
|
|
# <style type=text/css>STYLE</style>
|
|
# <style type=text/javascript>alert('xss')</style>
|
|
# <table background=javascript:...
|
|
# <td background=javascript:
|
|
#
|
|
#
|
|
# NOTES
|
|
#
|
|
# - Reference the WASC Script Mapping Project - http://projects.webappsec.org/Script-Mapping
|
|
#
|
|
# - Not using closing brackets because they are not needed for the
|
|
# attacks to succeed. The following seems to work in FF: <body/s/onload=...
|
|
#
|
|
# - Also, browsers sometimes tend to translate < into >, in order to "repair"
|
|
# what they think was a mistake made by the programmer/template designer.
|
|
#
|
|
# - Browsers are flexible when it comes to what they accept as separator between
|
|
# tag names and attributes. The following is commonly used in payloads: <img/src=...
|
|
# A better example: <BODY onload!#$%&()*~+-_.,:;?@[/|\]^=alert("XSS")>
|
|
#
|
|
# - Grave accents are sometimes used as an evasion technique (as a replacement for quotes),
|
|
# but I don't believe we need to look for quotes anywhere.
|
|
#
|
|
# - Links do not have to be fully qualified. For example, the following works:
|
|
# <script src="//ha.ckers.org/.j">
|
|
#
|
|
# This rule is also triggered by the following exploit(s):
|
|
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx <(?:a|abbr|acronym|address|applet|area|audioscope|b|base|basefront|bdo|bgsound|big|blackface|blink|blockquote|body|bq|br|button|caption|center|cite|code|col|colgroup|comment|dd|del|dfn|dir|div|dl|dt|em|embed|fieldset|fn|font|form|frame|frameset|h1|head|hr|html|i|iframe|ilayer|img|input|ins|isindex|kdb|keygen|label|layer|legend|li|limittext|link|listing|map|marquee|menu|meta|multicol|nobr|noembed|noframes|noscript|nosmartquotes|object|ol|optgroup|option|p|param|plaintext|pre|q|rt|ruby|s|samp|script|select|server|shadow|sidebar|small|spacer|span|strike|strong|style|sub|sup|table|tbody|td|textarea|tfoot|th|thead|title|tr|tt|u|ul|var|wbr|xml|xmp)\W" \
|
|
"id:941320,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:jsDecode,t:lowercase,\
|
|
msg:'Possible XSS Attack Detected - HTML Tag Handler',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242/63',\
|
|
tag:'PCI/6.5.1',\
|
|
tag:'paranoia-level/2',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
|
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i:[\"'][ ]*(?:[^a-z0-9~_:' ]|in).*?(?:(?:l|\x5cu006C)(?:o|\x5cu006F)(?:c|\x5cu0063)(?:a|\x5cu0061)(?:t|\x5cu0074)(?:i|\x5cu0069)(?:o|\x5cu006F)(?:n|\x5cu006E)|(?:n|\x5cu006E)(?:a|\x5cu0061)(?:m|\x5cu006D)(?:e|\x5cu0065)|(?:o|\x5cu006F)(?:n|\x5cu006E)(?:e|\x5cu0065)(?:r|\x5cu0072)(?:r|\x5cu0072)(?:o|\x5cu006F)(?:r|\x5cu0072)|(?:v|\x5cu0076)(?:a|\x5cu0061)(?:l|\x5cu006C)(?:u|\x5cu0075)(?:e|\x5cu0065)(?:O|\x5cu004F)(?:f|\x5cu0066)).*?=)" \
|
|
"id:941330,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:htmlEntityDecode,t:compressWhitespace,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
tag:'PCI/6.5.1',\
|
|
tag:'paranoia-level/2',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
|
|
|
# This rule is also triggered by the following exploit(s):
|
|
# [ SAP CRM Java vulnerability CVE-2018-2380 - Exploit tested: https://www.exploit-db.com/exploits/44292 ]
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx (?i)[\"\'][ ]*(?:[^a-z0-9~_:\' ]|in).+?[.].+?=" \
|
|
"id:941340,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,t:htmlEntityDecode,t:compressWhitespace,\
|
|
msg:'IE XSS Filters - Attack Detected',\
|
|
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'platform-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242',\
|
|
tag:'PCI/6.5.1',\
|
|
tag:'paranoia-level/2',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
|
|
|
#
|
|
# Defend against AngularJS client side template injection
|
|
#
|
|
# Of course, pure client-side AngularJS commands can not be intercepted.
|
|
# But once a command is sent to the server, the CRS will trigger.
|
|
#
|
|
# https://portswigger.net/blog/xss-without-html-client-side-template-injection-with-angularjs
|
|
#
|
|
# Example payload:
|
|
# http://localhost/login?user=%20x%20%7B%7Bconstructor.constructor(%27alert(1)%27)()%7D%7D%20.%20ff
|
|
# Decoded argument:
|
|
# {{constructor.constructor('alert(1)')()}}
|
|
#
|
|
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx {{.*?}}" \
|
|
"id:941380,\
|
|
phase:2,\
|
|
block,\
|
|
capture,\
|
|
t:none,\
|
|
msg:'AngularJS client side template injection detected',\
|
|
logdata:'Matched Data: Suspicious payload found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
|
|
tag:'application-multi',\
|
|
tag:'language-multi',\
|
|
tag:'attack-xss',\
|
|
tag:'OWASP_CRS',\
|
|
tag:'capec/1000/152/242/63',\
|
|
tag:'paranoia-level/2',\
|
|
ver:'OWASP_CRS/4.0.0-rc1',\
|
|
severity:'CRITICAL',\
|
|
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
|
setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
|
|
|
|
|
|
|
|
SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:941015,phase:1,pass,nolog,skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS"
|
|
SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:941016,phase:2,pass,nolog,skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS"
|
|
#
|
|
# -= Paranoia Level 3 =- (apply only when tx.detection_paranoia_level is sufficiently high: 3 or higher)
|
|
#
|
|
|
|
|
|
|
|
SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:941017,phase:1,pass,nolog,skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS"
|
|
SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 4" "id:941018,phase:2,pass,nolog,skipAfter:END-REQUEST-941-APPLICATION-ATTACK-XSS"
|
|
#
|
|
# -= Paranoia Level 4 =- (apply only when tx.detection_paranoia_level is sufficiently high: 4 or higher)
|
|
#
|
|
|
|
|
|
|
|
#
|
|
# -= Paranoia Levels Finished =-
|
|
#
|
|
SecMarker "END-REQUEST-941-APPLICATION-ATTACK-XSS"
|