Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Rule 933210 PHP Injection Attack FP

See original GitHub issue

_Issue originally created by user emphazer on date 2019-11-19 11:42:17. Link to original issue: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1626._

Type of Issue

Incorrect blocking (false positive)

Description

curl 'localhost/picture(5)(4).jpg'

[msg "PHP Injection Attack: Variable Function Call Found"] [data "Matched Data: (5)(4) found within REQUEST_FILENAME: /picture(5)(4).jpg"]

Your Environment

CRS version (e.g. v3.2.0):
ModSecurity version (e.g. 2.9.3):

any ideas?

Issue Analytics

State:
Created 3 years ago
Comments:10 (1 by maintainers)

Top GitHub Comments

1reaction

ymc-dabecommented, Dec 19, 2022

Thanks a lot for the info @RedXanadu, that is just great to hear 😃 We gone with an exclusion rule for now, but I will have a look to the updated rule in the v4.0 branch.

1reaction

CRS-migration-botcommented, May 13, 2020

User theMiddleBlue commented on date 2019-11-19 15:22:20:

Hi emphazer

the rule tries to catch PHP code injection bypass technique such as (string)"system"("uname");. Maybe we can remove the REQUEST_FILENAME from the rule, I need to do some tests. I’ll update this issue with more information.

thanks!

Top Results From Across the Web

Rule 933210 PHP Injection Attack FP · Issue #1626 - GitHub

the rule tries to catch PHP code injection bypass technique such as (string)"system"("uname"); . Maybe we can remove the REQUEST_FILENAME from ...

ModSecurity CRS Rule Group 933 Application Attack PHP

ModSecurity CRS Rule Group 933 Application Attack PHP. Checks for application attacks using PHP. View rules on GitHub. Rules. 933131 PHP Injection Attack: ......

Function Injection - OWASP Foundation

A Function Injection attack consists of insertion or “injection” of a function name from client to the application. A successful function injection exploit ......

SpiderLabs - Bountysource

Created 3 years ago in SpiderLabs/owasp-modsecurity-crs with 6 comments. Rule 933210 PHP Injection Attack FP. Type of Issue. Incorrect blocking (false positive) ...

owasp-modsecurity-crs: REQUEST-933-APPLICATION ...

Source code changes report for the member file rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf of the owasp-modsecurity-crs software package between the ...