Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Rule 941120: false positive for the Russian language

See original GitHub issue

Description

Caught a false positive on the words “употребляют наркотики”

941120 Matched Data: ;ONB = found within ARGS:json.description: #?>B@51;ONB =0@:>B8:8

ляют н
;ONB =

Audit Logs / Triggered Rule Numbers

"response":{"body":"<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n","http_code":403,"headers":{"Server":"","Server":"","Date":"Fri, 04 Dec 2020 15:21:01 GMT","Content-Length":"146","Content-Type":"text/html","Access-Control-Allow-Origin":"*","Connection":"close","Access-Control-Allow-Credentials":"true","Strict-Transport-Security":"max-age=15724800; includeSubDomains"}},"producer":{"modsecurity":"ModSecurity v3.0.4 (Linux)","connector":"ModSecurity-nginx v1.0.1","secrules_engine":"Enabled","components":["OWASP_CRS/3.3.0\""]},"messages":[{"message":"XSS Filter - Category 2: Event Handler Vector","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)[\\s\\\"'`;\\/0-9=\\x0B\\x09\\x0C\\x3B\\x2C\\x28\\x3B]on[a-zA-Z]+[\\s\\x0B\\x09\\x0C\\x3B\\x2C\\x28\\x3B]*?=' against variable `ARGS:json.description' (Value: `\\xd1\\x83\\xd0\\xbf\\xd0\\xbe\\xd1\\x82\\xd1\\x80\\xd0\\xb5\\xd0\\xb1\\xd0\\xbb\\xd1\\x8f\\xd1\\x8e\\xd1\\x82 \\xd0\\xbd\\xd
(61 characters omitted)' )","reference":"o7,6v17,41t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941120","file":"/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"89","data":"Matched Data: ;ONB = found within ARGS:json.description: C?>B@51;ONB =0@:>B8:8","severity":"2","ver":"OWASP_CRS/3.3.0","rev":"","tags":["application-multi","language-multi","platform-multi","attack-xss","paranoia-level/1","OWASP_CRS","capec/1000/152/242"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Score: 5)","details":{"match":"Matched \"Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' )","reference":"","ruleId":"949110","file":"/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"80","data":"","severity":"2","ver":"OWASP_CRS/3.3.0","rev":"","tags":["application-multi","language-multi","platform-multi","attack-generic"],"maturity":"0","accuracy":"0"}}]}}

Your Environment

CRS version (e.g., v3.2.0): v3.3.0
Paranoia level setting: 1
ModSecurity version (e.g., 2.9.3): v3.0.4
Image: k8s.gcr.io/ingress-nginx/controller:v0.41.2

Confirmation

[X] I have removed any personal data (email addresses, IP addresses, passwords, domain names) from any logs posted.

Issue Analytics

State:
Created 3 years ago
Comments:8 (6 by maintainers)

Top GitHub Comments

1reaction

dune73commented, Nov 15, 2021

We have not heard from original reporter, so I agree we close this until we get a better report that we can reproduce.

For the record: We are quite sure this or a similar problem exists. It’s just that we can not fix it if we can not reproduce it.

1reaction

azuritcommented, May 19, 2021

@franbuehler Did you have time to check if this is really related to ‘your’ issue https://github.com/coreruleset/coreruleset/issues/1942 ? Thanks for info!

Top Results From Across the Web

Rule 941310: false positive for Russian letters "м" and "о" #1942

Description I just enter a word from all the letters of the Russian alphabet and get a false positive. абвгдеёжзийклмнопрстуфхцчшщъыэюя – false positive...

Fix ModSecurity false positives on __cf_bm CloudFlare cookie

The OWASP/Modsecurity rule set contains a rule #941120, which tries to stop XSS attacks that attempt to exploit event handlers, ...

Music by Bob Dylan. By Betsy Bow- Press, 1982. [x, 239 p. - jstor

mind in both Mahler's Eighth Symphony and Beethoven's late quartets. Yet not for a moment does he believe that music can be translated...

How to tune your WAF installation to reduce false positives

This article will help you reduce false positives on NGINX, leaving you with a clean installation that allows legitimate requests to pass and ......

PROGRAM BUDGET - City of Ames

When a derecho with 90 miles per hour straight-line winds downed trees and snapped electric transmission poles, City employees and mutual ...