Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Rule 941130: False positive

See original GitHub issue

_Issue originally created by user Taiki-San on date 2019-10-03 16:52:49. Link to original issue: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1582._

Type of Issue

False positive.

Description

The rule incorrectly (I think) match patterns finishing with base64. Specifically, because of the starting [\s\S], patterns like blablabase64 will match.

I suspect the reason is that the regex tries to do too many things. Specifically, trying to touch the starting condition to simply be [\s] break the match of patterns like <!ENTITY % cgger SYSTEM. Not sure what a fix would be besides moving [\s\S] inside the OR condition of each pattern.

Confirmation

[X] I have removed any personal data (email addresses, IP addresses, passwords, domain names) from any logs posted.

Issue Analytics

State:
Created 3 years ago
Comments:5

Top GitHub Comments

1reaction

CRS-migration-botcommented, May 13, 2020

User dune73 commented on date 2020-02-26 19:07:39:

We took this to our CRS Meetup in Bern and wrote a fix together: #1701

Removing it from the meeting agenda.

0reactions

CRS-migration-botcommented, May 13, 2020

User Taiki-San commented on date 2020-02-14 08:00:24:

Thanks! I’m hoping to get a bit of time to focus on them in the coming weeks/months otherwise.

Top Results From Across the Web

Rule 941130: False positive · Issue #1582 - GitHub

False positive. Description. The rule incorrectly (I think) match patterns finishing with base64 . Specifically, because of the starting [\s\ ...

modsecurity owasp 941130 - ignore xhtml in request

Basically I just want to stop it from matching XHTML. Any better ways? To do this, you have to rewrite the complete rule....

Core Rule Set Inventory – Welcome to netnea

Rule ID Paranoia Level Severity 901001 PL1 none 901450 PL1 none 905100 PL1 none

Google Cloud Armor preconfigured WAF rules overview

A lower sensitivity level indicates a higher confidence signature, which is less likely to generate a false positive. A higher sensitivity level increases ......

CRS rule groups and rules - Azure Web Application Firewall

This is done through rules that are defined based on the OWASP core ... and fewer false positives compared with earlier versions of...