Failed to include some OS commands injection payloads in #REQUEST-932-APPLICATION-ATTACK-RCE rules

_Issue originally created by user umarfarook882 on date 2017-06-14 05:43:35. Link to original issue: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/809._

I have tested these payload on OWASP CRS, It failed to detect. I have checked the rule on REQUEST-932-APPLICATION-ATTACK-RCE, these payloads are not included on the regex pattern on any rules expect PS. but i can execute ps command on vulnerable application without specify arguments.

    127.0.0.1 && cd /root/Desktop/ && pwd && service --status-all 
    127.0.0.1 && ps
    127.0.0.1 && service mysql status
    127.0.0.1 && service apache2 status

For more information check my demo video on Github

[CRS-migration-bot]

User lifeforms commented on date 2017-06-14 08:43:28:

Hi Umar, thanks for the report 😃

Indeed we currently only check for the ps command when including a trailing argument. This was a tradeoff, since the string ps happened a few times in a testing data set. So the value of executing the command was compared to the possible false positives, and I decided to require an argument, so that for instance ps waux (showing all other uid’s processes) would be blocked, but the less interesting ps would be left through.

I also considered service, but in my recollection this also caused many positives in English text. Basically people could not use the word service on a newline, after some punctuation, after a ;, etc, and this happens sometimes in regular text. At the same time, the service command might provide some info leaks but usually the web server process should not run as root and therefore it’s not likely that an attacker could stop/start services.

The same goes for cd, it’s not too dangerous in itself (it can be used to discover paths of course) but it happened too often in natural English text so I removed it.

However pwd is definitely something we could block I think. I wonder why we don’t have that yet. I’ll have to test this on my Reddit comments dataset.

[CRS-migration-bot]

User fgsch commented on date 2019-10-20 22:16:33:

This issue has timed out as it has not received any update in over 2 years. If this is still a problem please open a new issue.