Mod_security rule exception for url/arg

user_1421795 0
Viewed 314

An image on our site is flagging a modsec rule I am trying to add a rule exception for only that occurrence. The number at the start of the flagged string is a session number, so I have added a regex to my rule.

I've tried various permutations but had no joy and would appreciate some advice.

Blocked URI: https://www.website.com/application/login?0--preLoginHeaderPanel-companyLogo

Modsec log snippet: [file "/usr/share/modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "65"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: 1c found within ARGS_NAME:0--preLoginHeaderPanel-companyLogo: 0--preLoginHeaderPanel-companyLogo"]

Attempted exceptions (within apache.conf): SecRuleUpdateTargetById 942100 !ARGS_NAMES:'[0-9][0-9]?--preLoginHeaderPanel-companyLogo'

mod-security
1 Answers

Core Rule Set Dev on Duty here. Rule 942100 is one of our 'LibInjection' rules. LibInjection is quite opaque (it's a third party library/operator), so you're correct that a rule exclusion is the way to fix this issue.

The use of regular expressions in this context follows a specific form. They need to be sandwiched inside forward slashes, like so:

SecRuleUpdateTargetById 942100 "!ARGS_NAMES:/^[0-9][0-9]?--preLoginHeaderPanel-companyLogo/"

I added in a starting anchor at the beginning of the regular expression. You might want to think whether anchoring at the end is a good idea, as well.

For more examples and information, we have some great documentation on this here: https://coreruleset.org/docs/configuring/false_positives_tuning/#support-for-regular-expressions

user_163229970
Related