Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Rule Id: 932150 false positive on time keyword

See original GitHub issue

Description

Request “/api/v1/query?q=time+warner”, “GET”, “1.1” returned 403.

Rule Id: 932150 phase: 2

Match, but no disruptive action: ModSecurity: Warning. Matched "Operator Rx' with parameter (?:^|=)\s*(?:{|\s*(\s*|\w+=(?:[^\s]|$.|$.|<.|>.|'.'|".")\s+|!\s|$)\s(?:‘|")(?:[?*[]()-|+\w’"./\\]+/)?[\\'"](?:l[\\’"](?😒(?:[\\'"](?:b[\\‘"]*_[\\’"]*r (6252 characters omitted)’ against variable ARGS:q' (Value: time warner’ ) [file “/opt/coreruleset/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf”] [line “444”] [id “932150”] [rev “”] [msg “Remote Command Execution: Direct Unix Command Execution”] [data “Matched Data: time found within ARGS:q: time warner”] [severity “2”] [ver “OWASP_CRS/3.3.0”] [maturity “0”] [accuracy “0”] [tag “application-multi”] [tag “language-shell”] [tag “platform-unix”] [tag “attack-rce”] [tag “paranoia-level/1”] [tag “OWASP_CRS”] [tag “capec/1000/152/248/88”] [tag “PCI/6.5.2”] [hostname “”] [uri “/api/v1/query”] [unique_id “161670536857.434291”] [ref “o0,5v20,11”]

Log: [client ] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator Ge' with parameter 5’ against variable TX:ANOMALY_SCORE' (Value: 5’ ) [file “/opt/coreruleset/rules/REQUEST-949-BLOCKING-EVALUATION.conf”] [line “138”] [id “949110”] [rev “”] [msg “Inbound Anomaly Score Exceeded (Total Score: 5)”] [data “”] [severity “2”] [ver “OWASP_CRS/3.3.0”] [maturity “0”] [accuracy “0”] [tag “application-multi”] [tag “language-multi”] [tag “platform-multi”] [tag “attack-generic”] [hostname “”] [uri “/api/v1/query”] [unique_id “161670536857.434291”] [ref “”] Intervention, returning code: 403

Your Environment

CRS version: default v3.4/dev
Paranoia level setting:
ModSecurity version : 3.0.4
Web Server and version :
Operating System and version: Amazon Linux 2

Confirmation

[x ] I have removed any personal data (email addresses, IP addresses, passwords, domain names) from any logs posted.

Issue Analytics

State:
Created 2 years ago
Comments:16 (13 by maintainers)

Top GitHub Comments

2reactions

lifeformscommented, Sep 18, 2021

I tried an approach which was not fruitful and I have to dig into it more. Thanks for your patience.

1reaction

noneislandcommented, Jun 23, 2021

Hi @noneisland

Do you have any updates here?

I’m willing to help.

But I am not sure how to build and test the changes.

Instructions on how to build the changes from scratch will help.

Top Results From Across the Web

FP on 932150 (PL1) with payload "ping" and "time" #2419

For now, due to time constraints, and balancing risk with false positives and maintenance load, we had already decided to remove the problematic ......

ModSecurity rule 932150 false positive, remove ruby from ...

I found this: "The Remote Command Execution Rule with the rule id 932150 is triggered by a Unix command followed by a white...

Including OWASP ModSecurity Core Rule Set - netnea

The signs are often keywords or typical patterns that may be suggestive of a wide variety of attacks. This also entails false alarms...

Web Application Firewall DRS rule groups and rules

The replaced rule reduces the risk of false positive detections from legitimate requests. Anomaly scoring. When you use DRS 2.0 or later, your ......

Contribution Guidelines :: Core Rule Set Documentation

If a PR only affects a single rule then the rule ID should be included in the ... something at the start of...