Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit 82ee8fe

Browse files
dune73dune73
authored
Merge pull request #964 from fgsch/fgsch/more-cleanup
More reorder and cleanups
2 parents de9b026 + 2362660 commit 82ee8fe

24 files changed

+475
-477
lines changed

‎rules/REQUEST-901-INITIALIZATION.conf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -55,10 +55,10 @@ SecRule &TX:crs_setup_version "@eq 0" \
5555
phase:1,\
5656
deny,\
5757
status:500,\
58-
auditlog,\
5958
log,\
60-
severity:'CRITICAL',\
61-
msg:'ModSecurity Core Rule Set is deployed without configuration! Please copy the crs-setup.conf.example template to crs-setup.conf, and include the crs-setup.conf file in your webserver configuration before including the CRS rules. See the INSTALL file in the CRS directory for detailed instructions.'"
59+
auditlog,\
60+
msg:'ModSecurity Core Rule Set is deployed without configuration! Please copy the crs-setup.conf.example template to crs-setup.conf, and include the crs-setup.conf file in your webserver configuration before including the CRS rules. See the INSTALL file in the CRS directory for detailed instructions.',\
61+
severity:'CRITICAL'"
6262

6363

6464
#

‎rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -292,8 +292,7 @@ SecRule REQUEST_METHOD "@streq POST" \
292292
nolog,\
293293
noauditlog,\
294294
chain"
295-
SecRule REQUEST_FILENAME \
296-
"@rx /file/ajax/field_asset_[a-z0-9_]+/[ua]nd/0/form-[a-z0-9A-Z_-]+$" \
295+
SecRule REQUEST_FILENAME "@rx /file/ajax/field_asset_[a-z0-9_]+/[ua]nd/0/form-[a-z0-9A-Z_-]+$" \
297296
"chain"
298297
SecRule REQUEST_HEADERS:Content-Length "@gt 31486341" \
299298
"chain"

‎rules/REQUEST-905-COMMON-EXCEPTIONS.conf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,8 @@
1414
# Exception for Apache SSL pinger
1515
#
1616
SecRule REQUEST_LINE "@streq GET /" \
17-
"phase:1,\
18-
id:905100,\
17+
"id:905100,\
18+
phase:1,\
1919
pass,\
2020
t:none,\
2121
nolog,\
@@ -33,8 +33,8 @@ SecRule REQUEST_LINE "@streq GET /" \
3333
# Exception for Apache internal dummy connection
3434
#
3535
SecRule REQUEST_LINE "@rx ^(?:GET /|OPTIONS \*) HTTP/[12]\.[01]$" \
36-
"phase:1,\
37-
id:905110,\
36+
"id:905110,\
37+
phase:1,\
3838
pass,\
3939
t:none,\
4040
nolog,\

‎rules/REQUEST-910-IP-REPUTATION.conf‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@
1212
#
1313

1414

15-
SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:1,id:910011,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
16-
SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:2,id:910012,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
15+
SecRule TX:PARANOIA_LEVEL "@lt 1" "id:910011,phase:1,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
16+
SecRule TX:PARANOIA_LEVEL "@lt 1" "id:910012,phase:2,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
1717
#
1818
# -= Paranoia Level 1 (default) =- (apply only when tx.paranoia_level is sufficiently high: 1 or higher)
1919
#
@@ -89,23 +89,23 @@ SecRule TX:HIGH_RISK_COUNTRY_CODES "!@rx ^$" \
8989
# This rule checks the client IP address against a list of recent IPs captured
9090
# from the SpiderLabs web honeypot systems (last 48 hours).
9191
#
92-
#SecRule TX:REAL_IP "@ipMatchFromFile ip_blacklist.data" \
92+
SecRule TX:REAL_IP "@ipMatchFromFile ip_blacklist.data" \
9393
"id:910110,\
9494
phase:2,\
9595
block,\
9696
t:none,\
97+
msg:'Client IP in Trustwave SpiderLabs IP Reputation Blacklist.',\
9798
tag:'application-multi',\
9899
tag:'language-multi',\
99100
tag:'platform-multi',\
100101
tag:'attack-reputation-ip',\
101-
msg:'Client IP in Trustwave SpiderLabs IP Reputation Blacklist.',\
102+
severity:'CRITICAL',\
102103
setvar:'tx.msg=%{rule.msg}',\
103104
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
104105
setvar:'tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var}',\
105106
setvar:'ip.reput_block_flag=1',\
106107
setvar:'ip.reput_block_reason=%{rule.msg}',\
107-
expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}',\
108-
severity:'CRITICAL'"
108+
expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'"
109109

110110

111111
#
@@ -280,24 +280,24 @@ SecMarker "END-RBL-LOOKUP"
280280
SecMarker "END-RBL-CHECK"
281281

282282

283-
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:1,id:910013,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
284-
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:2,id:910014,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
283+
SecRule TX:PARANOIA_LEVEL "@lt 2" "id:910013,phase:1,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
284+
SecRule TX:PARANOIA_LEVEL "@lt 2" "id:910014,phase:2,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
285285
#
286286
# -= Paranoia Level 2 =- (apply only when tx.paranoia_level is sufficiently high: 2 or higher)
287287
#
288288

289289

290290

291-
SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:1,id:910015,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
292-
SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:2,id:910016,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
291+
SecRule TX:PARANOIA_LEVEL "@lt 3" "id:910015,phase:1,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
292+
SecRule TX:PARANOIA_LEVEL "@lt 3" "id:910016,phase:2,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
293293
#
294294
# -= Paranoia Level 3 =- (apply only when tx.paranoia_level is sufficiently high: 3 or higher)
295295
#
296296

297297

298298

299-
SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:1,id:910017,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
300-
SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:2,id:910018,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
299+
SecRule TX:PARANOIA_LEVEL "@lt 4" "id:910017,phase:1,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
300+
SecRule TX:PARANOIA_LEVEL "@lt 4" "id:910018,phase:2,pass,nolog,skipAfter:END-REQUEST-910-IP-REPUTATION"
301301
#
302302
# -= Paranoia Level 4 =- (apply only when tx.paranoia_level is sufficiently high: 4 or higher)
303303
#

‎rules/REQUEST-911-METHOD-ENFORCEMENT.conf‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@
1313

1414

1515

16-
SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:1,id:911011,nolog,pass,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
17-
SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:2,id:911012,nolog,pass,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
16+
SecRule TX:PARANOIA_LEVEL "@lt 1" "id:911011,phase:1,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
17+
SecRule TX:PARANOIA_LEVEL "@lt 1" "id:911012,phase:2,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
1818
#
1919
# -= Paranoia Level 1 (default) =- (apply only when tx.paranoia_level is sufficiently high: 1 or higher)
2020
#
@@ -49,24 +49,24 @@ SecRule REQUEST_METHOD "!@within %{tx.allowed_methods}" \
4949

5050

5151

52-
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:1,id:911013,nolog,pass,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
53-
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:2,id:911014,nolog,pass,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
52+
SecRule TX:PARANOIA_LEVEL "@lt 2" "id:911013,phase:1,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
53+
SecRule TX:PARANOIA_LEVEL "@lt 2" "id:911014,phase:2,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
5454
#
5555
# -= Paranoia Level 2 =- (apply only when tx.paranoia_level is sufficiently high: 2 or higher)
5656
#
5757

5858

5959

60-
SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:1,id:911015,nolog,pass,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
61-
SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:2,id:911016,nolog,pass,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
60+
SecRule TX:PARANOIA_LEVEL "@lt 3" "id:911015,phase:1,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
61+
SecRule TX:PARANOIA_LEVEL "@lt 3" "id:911016,phase:2,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
6262
#
6363
# -= Paranoia Level 3 =- (apply only when tx.paranoia_level is sufficiently high: 3 or higher)
6464
#
6565

6666

6767

68-
SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:1,id:911017,nolog,pass,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
69-
SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:2,id:911018,nolog,pass,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
68+
SecRule TX:PARANOIA_LEVEL "@lt 4" "id:911017,phase:1,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
69+
SecRule TX:PARANOIA_LEVEL "@lt 4" "id:911018,phase:2,pass,nolog,skipAfter:END-REQUEST-911-METHOD-ENFORCEMENT"
7070
#
7171
# -= Paranoia Level 4 =- (apply only when tx.paranoia_level is sufficiently high: 4 or higher)
7272
#

‎rules/REQUEST-912-DOS-PROTECTION.conf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,8 @@ SecRule &TX:dos_burst_time_slice "@eq 0" \
8888
SecRule &TX:dos_block_timeout "@eq 0"
8989

9090

91-
SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:1,id:912011,nolog,pass,skipAfter:END-REQUEST-912-DOS-PROTECTION"
92-
SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:2,id:912012,nolog,pass,skipAfter:END-REQUEST-912-DOS-PROTECTION"
91+
SecRule TX:PARANOIA_LEVEL "@lt 1" "id:912011,phase:1,pass,nolog,skipAfter:END-REQUEST-912-DOS-PROTECTION"
92+
SecRule TX:PARANOIA_LEVEL "@lt 1" "id:912012,phase:2,pass,nolog,skipAfter:END-REQUEST-912-DOS-PROTECTION"
9393
#
9494
# -= Paranoia Level 1 (default) =- (apply only when tx.paranoia_level is sufficiently high: 1 or higher)
9595
#
@@ -242,9 +242,9 @@ SecRule IP:DOS_BURST_COUNTER "@ge 2" \
242242

243243

244244

245-
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:1,id:912013,nolog,pass,skipAfter:END-REQUEST-912-DOS-PROTECTION"
246-
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:2,id:912014,nolog,pass,skipAfter:END-REQUEST-912-DOS-PROTECTION"
247-
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:5,id:912019,nolog,pass,skipAfter:END-REQUEST-912-DOS-PROTECTION"
245+
SecRule TX:PARANOIA_LEVEL "@lt 2" "id:912013,phase:1,pass,nolog,skipAfter:END-REQUEST-912-DOS-PROTECTION"
246+
SecRule TX:PARANOIA_LEVEL "@lt 2" "id:912014,phase:2,pass,nolog,skipAfter:END-REQUEST-912-DOS-PROTECTION"
247+
SecRule TX:PARANOIA_LEVEL "@lt 2" "id:912019,phase:5,pass,nolog,skipAfter:END-REQUEST-912-DOS-PROTECTION"
248248
#
249249
# -= Paranoia Level 2 =- (apply only when tx.paranoia_level is sufficiently high: 2 or higher)
250250
#
@@ -273,16 +273,16 @@ SecRule IP:DOS_BURST_COUNTER "@ge 1" \
273273

274274

275275

276-
SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:1,id:912015,nolog,pass,skipAfter:END-REQUEST-912-DOS-PROTECTION"
277-
SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:2,id:912016,nolog,pass,skipAfter:END-REQUEST-912-DOS-PROTECTION"
276+
SecRule TX:PARANOIA_LEVEL "@lt 3" "id:912015,phase:1,pass,nolog,skipAfter:END-REQUEST-912-DOS-PROTECTION"
277+
SecRule TX:PARANOIA_LEVEL "@lt 3" "id:912016,phase:2,pass,nolog,skipAfter:END-REQUEST-912-DOS-PROTECTION"
278278
#
279279
# -= Paranoia Level 3 =- (apply only when tx.paranoia_level is sufficiently high: 3 or higher)
280280
#
281281

282282

283283

284-
SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:1,id:912017,nolog,pass,skipAfter:END-REQUEST-912-DOS-PROTECTION"
285-
SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:2,id:912018,nolog,pass,skipAfter:END-REQUEST-912-DOS-PROTECTION"
284+
SecRule TX:PARANOIA_LEVEL "@lt 4" "id:912017,phase:1,pass,nolog,skipAfter:END-REQUEST-912-DOS-PROTECTION"
285+
SecRule TX:PARANOIA_LEVEL "@lt 4" "id:912018,phase:2,pass,nolog,skipAfter:END-REQUEST-912-DOS-PROTECTION"
286286
#
287287
# -= Paranoia Level 4 =- (apply only when tx.paranoia_level is sufficiently high: 4 or higher)
288288
#

‎rules/REQUEST-913-SCANNER-DETECTION.conf‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@
1313

1414

1515

16-
SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:1,id:913011,nolog,pass,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
17-
SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:2,id:913012,nolog,pass,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
16+
SecRule TX:PARANOIA_LEVEL "@lt 1" "id:913011,phase:1,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
17+
SecRule TX:PARANOIA_LEVEL "@lt 1" "id:913012,phase:2,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
1818
#
1919
# -= Paranoia Level 1 (default) =- (apply only when tx.paranoia_level is sufficiently high: 1 or higher)
2020
#
@@ -109,8 +109,8 @@ SecRule REQUEST_FILENAME|ARGS "@pmf scanners-urls.data" \
109109
expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'"
110110

111111

112-
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:1,id:913013,nolog,pass,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
113-
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:2,id:913014,nolog,pass,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
112+
SecRule TX:PARANOIA_LEVEL "@lt 2" "id:913013,phase:1,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
113+
SecRule TX:PARANOIA_LEVEL "@lt 2" "id:913014,phase:2,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
114114
#
115115
# -= Paranoia Level 2 =- (apply only when tx.paranoia_level is sufficiently high: 2 or higher)
116116
#
@@ -191,16 +191,16 @@ SecRule REQUEST_HEADERS:User-Agent "@pmFromFile crawlers-user-agents.data" \
191191
expirevar:'ip.reput_block_flag=%{tx.reput_block_duration}'"
192192

193193

194-
SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:1,id:913015,nolog,pass,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
195-
SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:2,id:913016,nolog,pass,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
194+
SecRule TX:PARANOIA_LEVEL "@lt 3" "id:913015,phase:1,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
195+
SecRule TX:PARANOIA_LEVEL "@lt 3" "id:913016,phase:2,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
196196
#
197197
# -= Paranoia Level 3 =- (apply only when tx.paranoia_level is sufficiently high: 3 or higher)
198198
#
199199

200200

201201

202-
SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:1,id:913017,nolog,pass,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
203-
SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:2,id:913018,nolog,pass,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
202+
SecRule TX:PARANOIA_LEVEL "@lt 4" "id:913017,phase:1,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
203+
SecRule TX:PARANOIA_LEVEL "@lt 4" "id:913018,phase:2,pass,nolog,skipAfter:END-REQUEST-913-SCANNER-DETECTION"
204204
#
205205
# -= Paranoia Level 4 =- (apply only when tx.paranoia_level is sufficiently high: 4 or higher)
206206
#

‎rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@
2222
#
2323

2424

25-
SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:1,id:920011,nolog,pass,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
26-
SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:2,id:920012,nolog,pass,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
25+
SecRule TX:PARANOIA_LEVEL "@lt 1" "id:920011,phase:1,pass,nolog,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
26+
SecRule TX:PARANOIA_LEVEL "@lt 1" "id:920012,phase:2,pass,nolog,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
2727
#
2828
# -= Paranoia Level 1 (default) =- (apply only when tx.paranoia_level is sufficiently high: 1 or higher)
2929
#
@@ -57,8 +57,8 @@ SecRule REQUEST_LINE "!@rx ^(?i:(?:[a-z]{3,10}\s+(?:\w{3,7}?://[\w\-\./]*(?::\d+
5757
tag:'attack-protocol',\
5858
tag:'OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ',\
5959
tag:'CAPEC-272',\
60-
ver:'OWASP_CRS/3.0.0',\
6160
rev:2,\
61+
ver:'OWASP_CRS/3.0.0',\
6262
severity:'WARNING',\
6363
setvar:'tx.msg=%{rule.msg}',\
6464
setvar:'tx.anomaly_score=+%{tx.notice_anomaly_score}',\
@@ -108,8 +108,8 @@ SecRule FILES_NAMES|FILES "@rx (?<!&(?:[aAoOuUyY]uml)|&(?:[aAeEiIoOuU]circ)|&(?:
108108
tag:'attack-protocol',\
109109
tag:'OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ',\
110110
tag:'CAPEC-272',\
111-
ver:'OWASP_CRS/3.0.0',\
112111
rev:1,\
112+
ver:'OWASP_CRS/3.0.0',\
113113
severity:'CRITICAL',\
114114
setvar:'tx.msg=%{rule.msg}',\
115115
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
@@ -143,8 +143,8 @@ SecRule REQBODY_ERROR "!@eq 0" \
143143
tag:'attack-protocol',\
144144
tag:'OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ',\
145145
tag:'CAPEC-272',\
146-
ver:'OWASP_CRS/3.0.0',\
147146
rev:1,\
147+
ver:'OWASP_CRS/3.0.0',\
148148
severity:'CRITICAL',\
149149
setvar:'tx.msg=%{rule.msg}',\
150150
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
@@ -186,8 +186,8 @@ SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
186186
tag:'attack-protocol',\
187187
tag:'OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ',\
188188
tag:'CAPEC-272',\
189-
ver:'OWASP_CRS/3.0.0',\
190189
rev:1,\
190+
ver:'OWASP_CRS/3.0.0',\
191191
severity:'CRITICAL',\
192192
setvar:'tx.msg=%{rule.msg}',\
193193
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
@@ -253,8 +253,8 @@ SecRule REQUEST_METHOD "@rx ^(?:GET|HEAD)$" \
253253
tag:'attack-protocol',\
254254
tag:'OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ',\
255255
tag:'CAPEC-272',\
256-
ver:'OWASP_CRS/3.0.0',\
257256
rev:1,\
257+
ver:'OWASP_CRS/3.0.0',\
258258
severity:'CRITICAL',\
259259
chain"
260260
SecRule REQUEST_HEADERS:Content-Length "!@rx ^0?$" \
@@ -280,8 +280,8 @@ SecRule REQUEST_METHOD "@rx ^(?:GET|HEAD)$" \
280280
tag:'attack-protocol',\
281281
tag:'OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ',\
282282
tag:'CAPEC-272',\
283-
ver:'OWASP_CRS/3.1.0',\
284283
rev:1,\
284+
ver:'OWASP_CRS/3.1.0',\
285285
severity:'CRITICAL',\
286286
chain"
287287
SecRule &REQUEST_HEADERS:Transfer-Encoding "!@eq 0" \
@@ -314,8 +314,8 @@ SecRule REQUEST_METHOD "@rx ^POST$" \
314314
tag:'attack-protocol',\
315315
tag:'OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ',\
316316
tag:'CAPEC-272',\
317-
ver:'OWASP_CRS/3.0.0',\
318317
rev:1,\
318+
ver:'OWASP_CRS/3.0.0',\
319319
severity:'WARNING',\
320320
chain"
321321
SecRule &REQUEST_HEADERS:Content-Length "@eq 0" \
@@ -1106,8 +1106,8 @@ SecRule REQUEST_HEADERS_NAMES "@rx ^.*$" \
11061106
setvar:'tx.%{rule.id}-OWASP_CRS/POLICY/HEADERS_RESTRICTED-%{matched_var_name}=%{matched_var}'"
11071107

11081108

1109-
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:1,id:920013,nolog,pass,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1110-
SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:2,id:920014,nolog,pass,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1109+
SecRule TX:PARANOIA_LEVEL "@lt 2" "id:920013,phase:1,pass,nolog,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1110+
SecRule TX:PARANOIA_LEVEL "@lt 2" "id:920014,phase:2,pass,nolog,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
11111111
#
11121112
# -= Paranoia Level 2 =- (apply only when tx.paranoia_level is sufficiently high: 2 or higher)
11131113
#
@@ -1307,16 +1307,16 @@ SecRule FILES_NAMES|FILES "@rx ['\";=]" \
13071307
tag:'OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ',\
13081308
tag:'CAPEC-272',\
13091309
tag:'paranoia-level/2',\
1310-
ver:'OWASP_CRS/3.0.0',\
13111310
rev:1,\
1311+
ver:'OWASP_CRS/3.0.0',\
13121312
severity:'CRITICAL',\
13131313
setvar:'tx.msg=%{rule.msg}',\
13141314
setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
13151315
setvar:'tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/INVALID_REQ-%{matched_var_name}=%{matched_var}'"
13161316

13171317

1318-
SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:1,id:920015,nolog,pass,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1319-
SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:2,id:920016,nolog,pass,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1318+
SecRule TX:PARANOIA_LEVEL "@lt 3" "id:920015,phase:1,pass,nolog,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1319+
SecRule TX:PARANOIA_LEVEL "@lt 3" "id:920016,phase:2,pass,nolog,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
13201320
#
13211321
# -= Paranoia Level 3 =- (apply only when tx.paranoia_level is sufficiently high: 3 or higher)
13221322
#
@@ -1344,8 +1344,8 @@ SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES|REQUEST_BODY "@validateByteR
13441344
setvar:'tx.%{rule.id}-OWASP_CRS/PROTOCOL_VIOLATION/EVASION-%{matched_var_name}=%{matched_var}'"
13451345

13461346

1347-
SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:1,id:920017,nolog,pass,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1348-
SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:2,id:920018,nolog,pass,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1347+
SecRule TX:PARANOIA_LEVEL "@lt 4" "id:920017,phase:1,pass,nolog,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
1348+
SecRule TX:PARANOIA_LEVEL "@lt 4" "id:920018,phase:2,pass,nolog,skipAfter:END-REQUEST-920-PROTOCOL-ENFORCEMENT"
13491349
#
13501350
# -= Paranoia Level 4 =- (apply only when tx.paranoia_level is sufficiently high: 4 or higher)
13511351
#

0 commit comments

Comments
 (0)