Skip to content

Commit e98dbf8

Browse files
blotusblotus
authored
flatten CRS rules to workaround crowdsecurity/crowdsec#3343 (#83)
1 parent 41c4bca commit e98dbf8

26 files changed

+536
-6830
lines changed

‎appsec/crs/REQUEST-901-INITIALIZATION.conf

+34-241
Large diffs are not rendered by default.

‎appsec/crs/REQUEST-905-COMMON-EXCEPTIONS.conf

+5-35
Original file line numberDiff line numberDiff line change
@@ -14,42 +14,12 @@
1414
#
1515
# Exception for Apache SSL pinger
1616
#
17-
SecRule REQUEST_LINE "@streq GET /" \
18-
"id:905100,\
19-
phase:1,\
20-
pass,\
21-
t:none,\
22-
nolog,\
23-
tag:'application-multi',\
24-
tag:'language-multi',\
25-
tag:'platform-apache',\
26-
tag:'attack-generic',\
27-
ver:'OWASP_CRS/4.0.0-rc1',\
28-
chain"
29-
SecRule REMOTE_ADDR "@ipMatch 127.0.0.1,::1" \
30-
"t:none,\
31-
ctl:ruleRemoveByTag=OWASP_CRS,\
32-
ctl:auditEngine=Off"
17+
SecRule REQUEST_LINE "@streq GET /" "id:905100, phase:1, pass, t:none, nolog, tag:'application-multi', tag:'language-multi', tag:'platform-apache', tag:'attack-generic', ver:'OWASP_CRS/4.0.0-rc1', chain"
18+
SecRule REMOTE_ADDR "@ipMatch 127.0.0.1,::1" "t:none, ctl:ruleRemoveByTag=OWASP_CRS, ctl:auditEngine=Off"
3319

3420
#
3521
# Exception for Apache internal dummy connection
3622
#
37-
SecRule REMOTE_ADDR "@ipMatch 127.0.0.1,::1" \
38-
"id:905110,\
39-
phase:1,\
40-
pass,\
41-
t:none,\
42-
nolog,\
43-
tag:'application-multi',\
44-
tag:'language-multi',\
45-
tag:'platform-apache',\
46-
tag:'attack-generic',\
47-
ver:'OWASP_CRS/4.0.0-rc1',\
48-
chain"
49-
SecRule REQUEST_HEADERS:User-Agent "@endsWith (internal dummy connection)" \
50-
"t:none,\
51-
chain"
52-
SecRule REQUEST_LINE "@rx ^(?:GET /|OPTIONS \*) HTTP/[12]\.[01]$" \
53-
"t:none,\
54-
ctl:ruleRemoveByTag=OWASP_CRS,\
55-
ctl:auditEngine=Off"
23+
SecRule REMOTE_ADDR "@ipMatch 127.0.0.1,::1" "id:905110, phase:1, pass, t:none, nolog, tag:'application-multi', tag:'language-multi', tag:'platform-apache', tag:'attack-generic', ver:'OWASP_CRS/4.0.0-rc1', chain"
24+
SecRule REQUEST_HEADERS:User-Agent "@endsWith (internal dummy connection)" "t:none, chain"
25+
SecRule REQUEST_LINE "@rx ^(?:GET /|OPTIONS \*) HTTP/[12]\.[01]$" "t:none, ctl:ruleRemoveByTag=OWASP_CRS, ctl:auditEngine=Off"

‎appsec/crs/REQUEST-911-METHOD-ENFORCEMENT.conf

+1-17
Original file line numberDiff line numberDiff line change
@@ -25,23 +25,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:911012,phase:2,pass,nolog,skipAf
2525
#
2626
# tx.allowed_methods is defined in the crs-setup.conf file
2727
#
28-
SecRule REQUEST_METHOD "!@within %{tx.allowed_methods}" \
29-
"id:911100,\
30-
phase:1,\
31-
block,\
32-
msg:'Method is not allowed by policy',\
33-
logdata:'%{MATCHED_VAR}',\
34-
tag:'application-multi',\
35-
tag:'language-multi',\
36-
tag:'platform-multi',\
37-
tag:'attack-generic',\
38-
tag:'paranoia-level/1',\
39-
tag:'OWASP_CRS',\
40-
tag:'capec/1000/210/272/220/274',\
41-
tag:'PCI/12.1',\
42-
ver:'OWASP_CRS/4.0.0-rc1',\
43-
severity:'CRITICAL',\
44-
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
28+
SecRule REQUEST_METHOD "!@within %{tx.allowed_methods}" "id:911100, phase:1, block, msg:'Method is not allowed by policy', logdata:'%{MATCHED_VAR}', tag:'application-multi', tag:'language-multi', tag:'platform-multi', tag:'attack-generic', tag:'paranoia-level/1', tag:'OWASP_CRS', tag:'capec/1000/210/272/220/274', tag:'PCI/12.1', ver:'OWASP_CRS/4.0.0-rc1', severity:'CRITICAL', setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
4529

4630

4731

‎appsec/crs/REQUEST-913-SCANNER-DETECTION.conf

+10-101
Original file line numberDiff line numberDiff line change
@@ -34,69 +34,14 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 1" "id:913012,phase:2,pass,nolog,skipAf
3434
# Chained rule is allow listing:
3535
# YUM package manager of CentOS / Fedore: User-Agent: urlgrabber/3.10 yum/3.4.3
3636
# eCairn service: User-Agent: mozilla/5.0 ecairn-grabber/1.0 (+http://ecairn.com/grabber)
37-
SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scanners-user-agents.data" \
38-
"id:913100,\
39-
phase:1,\
40-
block,\
41-
capture,\
42-
t:none,\
43-
msg:'Found User-Agent associated with security scanner',\
44-
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
45-
tag:'application-multi',\
46-
tag:'language-multi',\
47-
tag:'platform-multi',\
48-
tag:'attack-reputation-scanner',\
49-
tag:'paranoia-level/1',\
50-
tag:'OWASP_CRS',\
51-
tag:'capec/1000/118/224/541/310',\
52-
tag:'PCI/6.5.10',\
53-
ver:'OWASP_CRS/4.0.0-rc1',\
54-
severity:'CRITICAL',\
55-
chain"
56-
SecRule MATCHED_VARS "!@rx ^(?:urlgrabber/[0-9\.]+ yum/[0-9\.]+|mozilla/[0-9\.]+ ecairn-grabber/[0-9\.]+ \(\+http://ecairn.com/grabber\))$" \
57-
"setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
58-
59-
SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@pmFromFile scanners-headers.data" \
60-
"id:913110,\
61-
phase:1,\
62-
block,\
63-
capture,\
64-
t:none,\
65-
msg:'Found request header associated with security scanner',\
66-
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
67-
tag:'application-multi',\
68-
tag:'language-multi',\
69-
tag:'platform-multi',\
70-
tag:'attack-reputation-scanner',\
71-
tag:'paranoia-level/1',\
72-
tag:'OWASP_CRS',\
73-
tag:'capec/1000/118/224/541/310',\
74-
tag:'PCI/6.5.10',\
75-
ver:'OWASP_CRS/4.0.0-rc1',\
76-
severity:'CRITICAL',\
77-
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
78-
79-
80-
81-
SecRule REQUEST_FILENAME|ARGS "@pmFromFile scanners-urls.data" \
82-
"id:913120,\
83-
phase:2,\
84-
block,\
85-
capture,\
86-
t:none,\
87-
msg:'Found request filename/argument associated with security scanner',\
88-
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
89-
tag:'application-multi',\
90-
tag:'language-multi',\
91-
tag:'platform-multi',\
92-
tag:'attack-reputation-scanner',\
93-
tag:'paranoia-level/1',\
94-
tag:'OWASP_CRS',\
95-
tag:'capec/1000/118/224/541/310',\
96-
tag:'PCI/6.5.10',\
97-
ver:'OWASP_CRS/4.0.0-rc1',\
98-
severity:'CRITICAL',\
99-
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
37+
SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scanners-user-agents.data" "id:913100, phase:1, block, capture, t:none, msg:'Found User-Agent associated with security scanner', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', tag:'application-multi', tag:'language-multi', tag:'platform-multi', tag:'attack-reputation-scanner', tag:'paranoia-level/1', tag:'OWASP_CRS', tag:'capec/1000/118/224/541/310', tag:'PCI/6.5.10', ver:'OWASP_CRS/4.0.0-rc1', severity:'CRITICAL', chain"
38+
SecRule MATCHED_VARS "!@rx ^(?:urlgrabber/[0-9\.]+ yum/[0-9\.]+|mozilla/[0-9\.]+ ecairn-grabber/[0-9\.]+ \(\+http://ecairn.com/grabber\))$" "setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
39+
40+
SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@pmFromFile scanners-headers.data" "id:913110, phase:1, block, capture, t:none, msg:'Found request header associated with security scanner', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', tag:'application-multi', tag:'language-multi', tag:'platform-multi', tag:'attack-reputation-scanner', tag:'paranoia-level/1', tag:'OWASP_CRS', tag:'capec/1000/118/224/541/310', tag:'PCI/6.5.10', ver:'OWASP_CRS/4.0.0-rc1', severity:'CRITICAL', setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
41+
42+
43+
44+
SecRule REQUEST_FILENAME|ARGS "@pmFromFile scanners-urls.data" "id:913120, phase:2, block, capture, t:none, msg:'Found request filename/argument associated with security scanner', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', tag:'application-multi', tag:'language-multi', tag:'platform-multi', tag:'attack-reputation-scanner', tag:'paranoia-level/1', tag:'OWASP_CRS', tag:'capec/1000/118/224/541/310', tag:'PCI/6.5.10', ver:'OWASP_CRS/4.0.0-rc1', severity:'CRITICAL', setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
10045

10146

10247
SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:913013,phase:1,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
@@ -115,25 +60,7 @@ SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 2" "id:913014,phase:2,pass,nolog,skipAf
11560
#
11661
# This rule is a sibling of rule 913100.
11762
#
118-
SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scripting-user-agents.data" \
119-
"id:913101,\
120-
phase:1,\
121-
block,\
122-
capture,\
123-
t:none,\
124-
msg:'Found User-Agent associated with scripting/generic HTTP client',\
125-
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
126-
tag:'application-multi',\
127-
tag:'language-multi',\
128-
tag:'platform-multi',\
129-
tag:'attack-reputation-scripting',\
130-
tag:'OWASP_CRS',\
131-
tag:'capec/1000/118/224/541/310',\
132-
tag:'PCI/6.5.10',\
133-
tag:'paranoia-level/2',\
134-
ver:'OWASP_CRS/4.0.0-rc1',\
135-
severity:'CRITICAL',\
136-
setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
63+
SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scripting-user-agents.data" "id:913101, phase:1, block, capture, t:none, msg:'Found User-Agent associated with scripting/generic HTTP client', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', tag:'application-multi', tag:'language-multi', tag:'platform-multi', tag:'attack-reputation-scripting', tag:'OWASP_CRS', tag:'capec/1000/118/224/541/310', tag:'PCI/6.5.10', tag:'paranoia-level/2', ver:'OWASP_CRS/4.0.0-rc1', severity:'CRITICAL', setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
13764

13865

13966

@@ -146,25 +73,7 @@ SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scripting-user-agents.data" \
14673
#
14774
# This rule is a sibling of rule 913100.
14875
#
149-
SecRule REQUEST_HEADERS:User-Agent "@pmFromFile crawlers-user-agents.data" \
150-
"id:913102,\
151-
phase:1,\
152-
block,\
153-
capture,\
154-
t:none,\
155-
msg:'Found User-Agent associated with web crawler/bot',\
156-
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
157-
tag:'application-multi',\
158-
tag:'language-multi',\
159-
tag:'platform-multi',\
160-
tag:'attack-reputation-crawler',\
161-
tag:'OWASP_CRS',\
162-
tag:'capec/1000/118/116/150',\
163-
tag:'PCI/6.5.10',\
164-
tag:'paranoia-level/2',\
165-
ver:'OWASP_CRS/4.0.0-rc1',\
166-
severity:'CRITICAL',\
167-
setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
76+
SecRule REQUEST_HEADERS:User-Agent "@pmFromFile crawlers-user-agents.data" "id:913102, phase:1, block, capture, t:none, msg:'Found User-Agent associated with web crawler/bot', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', tag:'application-multi', tag:'language-multi', tag:'platform-multi', tag:'attack-reputation-crawler', tag:'OWASP_CRS', tag:'capec/1000/118/116/150', tag:'PCI/6.5.10', tag:'paranoia-level/2', ver:'OWASP_CRS/4.0.0-rc1', severity:'CRITICAL', setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
16877

16978

17079
SecRule TX:DETECTION_PARANOIA_LEVEL "@lt 3" "id:913015,phase:1,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"

0 commit comments

Comments
 (0)