Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

RCE detection bypass at PL1

See original GitHub issue

_Issue originally created by user dune73 on date 2019-08-19 07:06:16. Link to original issue: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1513._

The following bypass was pasted on twitter.

{ 1 }; ;+$u+cat+/etc$u/passwd$u
{ 2 }; ;+$u+cat+/etc$u/passwd+\#

https://twitter.com/spyerror/status/1162826904833089541?s=19

According to franbuehler, this passes on PL1, but is being detected on PL2.

Type of Issue

RCE rule detection bypass

Description

See above.

Your Environment

CRS 3.1

Confirmation

[X] I have removed any personal data (email addresses, IP addresses, passwords, domain names) from any logs posted.

Issue Analytics

State:
Created 3 years ago
Comments:7 (1 by maintainers)

Top GitHub Comments

1reaction

CRS-migration-botcommented, May 13, 2020

User marcstern commented on date 2019-08-20 06:30:12:

This evasion technique (and several others) can be defeated with the t:bash transformation - see https://www.approach.be/en/modsecurity.html

1reaction

CRS-migration-botcommented, May 13, 2020

User franbuehler commented on date 2019-08-19 07:34:37:

First command gets the following scores: individual paranoia level scores: 0, 13, 11, 13

Second command: individual paranoia level scores: 0, 18, 11, 13

Top Results From Across the Web

ImpressCMS: from unauthenticated SQL injection to RCE

In this blog post we will see how to bypass such a security mechanism to exploit a couple vulnerabilities I discovered about a...

Web Application Firewall (WAF) Evasion Techniques - Medium

All moderns Web Application Firewall are able to intercept (and even block) RCE attempts, but when it happens in a Linux system we've...

How the CRS protects the vulnerable web application Pixi by ...

It says that the access was denied (id: 949110) and that the Inbound Anomaly Score of the request at PL1 was 5 (id:...

Volume 22 – Number 37 | SANS @RISK - SANS Institute

Title: SQL injection bypass vulnerability in Modsecurity owasp-modsecurity-crs ... 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability.

CVE - Search Results - MITRE

The multipart payload will therefore bypass detection. ... owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability.