Rule 933210 PHP Injection Attack FP

[emphazer]

Rule 933210 PHP Injection Attack FP

Type of Issue

Incorrect blocking (false positive)

Description

curl 'localhost/picture(5)(4).jpg'

[msg "PHP Injection Attack: Variable Function Call Found"] [data "Matched Data: (5)(4) found within REQUEST_FILENAME: /picture(5)(4).jpg"]

Your Environment

• CRS version (e.g. v3.2.0):
• ModSecurity version (e.g. 2.9.3):

any ideas?

[emphazer]

@theMiddleBlue do you have any ideas?

[theMiddleBlue]

Hi @emphazer

the rule tries to catch PHP code injection bypass technique such as (string)"system"("uname");. Maybe we can remove the REQUEST_FILENAME from the rule, I need to do some tests. I'll update this issue with more information.

thanks!

[dune73]

I am not sure this is what we want.

How about URLs like /app/index.php/connector/<parameter>. On a reverse proxy, this is part of the REQUEST_FILENAME.

But I agree we need to do something about the false positive.

[theMiddleBlue]

How about URLs like /app/index.php/connector/. On a reverse proxy, this is part of the REQUEST_FILENAME.

totally agree, didn't think about it. need more time to test :/

[github-actions]

This issue has been open 120 days with no activity. Remove the stale label or comment, or this will be closed in 14 days

[emphazer]

any news here?