Content-Type: ... charset=ibm037 and friends allow for a bypass

_Issue originally created by user dune73 on date 2018-07-08 21:05:08. Link to original issue: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1137._

Payload: post_param1=<script>alert(000)</script>&post_param2=<script>alert(111)</script> Encoded: %97%96%A2%A3m%97%81%99%81%94%F1%7EL%A2%83%99%89%97%A3n%81%93%85%99%A3M%F0%F0%F0%5DLa%A2%83%99%89%97%A3nP%97%96%A2%A3m%97%81%99%81%94%F2%7EL%A2%83%99%89%97%A3n%81%93%85%99%A3M%F1%F1%F1%5DLa%A2%83%99%89%97%A3n

Attack:

POST /index.html?a=1 HTTP/1.1
...
Content-Type: application/x-www-form-urlencoded;charset=ibm037
...

%97%96%A2%A3m%97%81%99%81%94%F1%7EL%A2%83%99%89%97%A3n%81%93%85%99%A3M%F0%F0%F0%5DLa%A2%83%99%89%97%A3nP%97%96%A2%A3m%97%81%99%81%94%F2%7EL%A2%83%99%89%97%A3n%81%93%85%99%A3M%F1%F1%F1%5DLa%A2%83%99%89%97%A3n

This brings the following results (CRS 3.0.2 on ModSec 2.9.2)

PL1: 0
PL2: 3
PL3: 16
PL4: 29

Extracted from https://www.slideshare.net/SoroushDalili/waf-bypass-techniques-using-http-standard-and-web-servers-behaviour slide 32.

The presentation also looks into multipart transfer with special encodings. That might be even harder to catch.

I take it, we need to create a whitelist for these encodings. UTF-8 seems like a minimal entry, but what other encodings do we need by default?

Also: This is quite a thing and I think we need to create something for 3.1.

[CRS-migration-bot]

User emphazer commented on date 2018-07-20 07:05:18:

dune73 you should definetly add ISO-8859-1 3-5% will need it. especially for older pages

[CRS-migration-bot]

User dune73 commented on date 2018-07-11 11:44:41:

#1076 / Hybrid Paranoia Mode is ready to be merged without any remaining conflicts.