FP 949110 - cookie with (*.)/(.*) in value

Description

i add cookie with value (asd)/(asd) , and get block from modSecurity (you can add any text in bracket)

Audit Logs / Triggered Rule Numbers

2020/12/09 12:47:45 [error] 5866#5866: *2716173 [client x.x.x.x] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "80"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "x.x.x.x"] [uri "/"] [unique_id "160751806528.147812"] [ref ""], client: x.x.x.x, server: dev.app.comp.ru, request: "GET / HTTP/2.0", host: "dev.app.comp.ru"

Your Environment

• CRS version (e.g., v3.2.0): v3.3.0
• Paranoia level setting: 1
• ModSecurity version (e.g., 2.9.3): v3.0.4
• Web Server and version (e.g., apache 2.4.41): k8s.gcr.io/ingress-nginx/controller:v0.41.2

Confirmation

[x] I have removed any personal data (email addresses, IP addresses, passwords, domain names) from any logs posted.

[airween]

@lelvisl the fix had merged into the v3.4/dev. I’m going to close this issue - thanks again for your report.

[dune73]

Yes, but that’s paranoia level 4 and thus not default install.