Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Check for abnormal character escapes (-> \c, \d, etc.)

See original GitHub issue

_Issue originally created by user dune73 on date 2016-07-08 04:04:29. Link to original issue: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/393._

The whitespace escapes are well known and perfectly acceptable: \f, \t, \n, \r, \v, ....

But why would anybody escape \c? This smells like evasion and I think we should test for this practice.

Such a rule is probably something for PL 3 or 4.

Issue Analytics

State:
Created 3 years ago
Comments:11

Top GitHub Comments

1reaction

CRS-migration-botcommented, May 13, 2020

User dune73 commented on date 2016-07-08 16:05:03:

curl localhost -d "file=cat+/etc/pa\ssw\d"

is currently not triggering any rule in 3.0.0dev. It’s going to be caught by the os file injection rule as soon as the new version is ready. But I think that \s and \d stinks and they should be detected. Backends tend to ignore these irrelevant backslashes depending on the parser. Even the ModSec transformations do.

0reactions

CRS-migration-botcommented, May 13, 2020

User dune73 commented on date 2016-08-04 11:47:59:

See PR in #474. Closing this issue now.