Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

False Positive in 920220

See original GitHub issue

Description

920220 execute validateUrlEncoding over the whole REQUEST_URI. This lead to a false positive when a request comes with an argument value that contains a percentage (example with=100%&heigth=100%). Even if the argument width is correctly encoded (width=100%25&...) the rule triggers maybe because %25&h is not a valid hex sequence.

What about replacing REQUEST_URI with ARGS? Moreover, in the rule logic comment, we mention something about REQUEST_BODY. Is it related to something that has been removed?

Audit Logs / Triggered Rule Numbers

Request: /admin/index.php?width=100%25&height=270

Rule: 920220 URL Encoding Abuse Attack Attempt

https://github.com/coreruleset/coreruleset/blob/de26f0df363733ae3414ef20653ca8d5281188da/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf#L347-L379

Issue Analytics

State:
Created 3 years ago
Comments:9 (8 by maintainers)

Top GitHub Comments

1reaction

fgschcommented, Jun 1, 2020

Maybe we should start to put a condition to certain rules or to write a different version of the same rule to keep compatibility with v2 and v3. something like:

Sounds like a topic for tonight’s meeting 😄

1reaction

fgschcommented, Jun 1, 2020

IIRC when using REQUEST_URI the query string is not automatically url-decoded, so the rule should be seeing /test.php?w=100%25&h=100. I will confirm tomorrow but this sounds like a non-backward compatible change in modsec 3.

Top Results From Across the Web

Rule 920220 Query Parameters detecting malformed ... - GitHub

Seems the REQUEST_URI is valid to me in this request (%25's replacing for the % character for url encoded). Unsure why it's blocking...

Toxicologic Testing for Opiates: Understanding False-Positive ...

False -positive screens are the result of cross-reactivity to the antibody in EIA tests due to specific medications or direct binding to the...

False-Positive TST Reactions - CDC

Several factors can lead to false-positive and false-negative skin test reactions. False-positive reactions may be caused by. •Nontuberculous mycobacteria.

Potential for False Positive Results with Antigen Tests ... - FDA

Laboratories should expect some false positive results when screening large populations with a low prevalence of COVID-19 infection.

False Positive - Glossary | CSRC

False Positive · An alert that incorrectly indicates that a vulnerability is present. · An alert that incorrectly indicates that malicious activity is...