Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit f83ac77

Browse files
lifeformslifeforms
committed
Merge branch 'v3.2/dev' into v3.3/dev
2 parents 6debcaf + 462d2a1 commit f83ac77

8 files changed

+45
-52
lines changed

‎INSTALL‎

Lines changed: 28 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -29,25 +29,21 @@ Installing From a Package Manager
2929

3030
modsecurity-crs - Debian
3131
mod_security_crs - Fedora
32-
modsecurity-crs - Gentoo
32+
modsecurity-crs - Gentoo
3333

3434
Packages of CRS 2.x are incompatible with CRS 3.x.
3535

36-
Installing From Git
37-
===================
36+
Installing
37+
==========
3838

39-
Github is the preferred way to download and install CRS. Doing so
40-
insures that you have the most recent version of the rules. We
41-
encourage you to create scripts that will automatically download
42-
updates at regular intervals so that you may be protected against
43-
the latest threats that CRS adds protection for.
39+
You can download a copy of the CRS from the following URL:
40+
https://coreruleset.org/installation/
4441

45-
The script util/upgrade.py is an example for script. You can use
46-
it as follows:
42+
Our release zip/tar.gz files are the preferred way to install CRS.
4743

48-
```
49-
./util/upgrade.py --crs
50-
```
44+
However, if you want to follow rule development closely and get
45+
the newest protections quickly, you can also clone our GitHub
46+
repository to get the current work-in-progress for the next release.
5147

5248
Prerequisites
5349
-------------
@@ -85,20 +81,19 @@ Installing on Apache
8581
to create a new folder underneath the Apache directory (typically
8682
/usr/local/apache/, /etc/httpd/, or /etc/apache2). Often this folder
8783
is called 'modsecurity.d'. Create this folder and cd into it.
88-
4. Clone the repository into the modsecurity.d folder using:
89-
```git clone https://github.com/SpiderLabs/owasp-modsecurity-crs .```
90-
This will create a new owasp-modsecurity-crs folder.
84+
4. Download our release from https://coreruleset.org/installation/
85+
and unpack it into a new owasp-modsecurity-crs folder.
9186
5. Move the crs-setup.conf.example file to crs-setup.conf.
9287
Please take the time to go through this file and customize the settings
93-
for your local environment. Failure to do so may result in false
94-
negatives and false positives. See the section entitled OWASP CRS
88+
for your local environment. Failure to do so may result in false
89+
negatives and false positives. See the section entitled OWASP CRS
9590
Configuration for more detail.
9691
6. Rename rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example and
9792
rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example to remove the
9893
'.example' extension. This will allow you to add exclusions without updates
9994
overwriting them in the future.
100-
7. Add the following line to your httpd.conf/apache2.conf (the following
101-
assumes you've cloned CRS into modsecurity.d/owasp-modsecurity-crs). You
95+
7. Add the following line to your httpd.conf/apache2.conf (the following
96+
assumes you've put CRS into modsecurity.d/owasp-modsecurity-crs). You
10297
can alternatively place these in any config file included by Apache:
10398
```
10499
<IfModule security2_module>
@@ -121,8 +116,8 @@ Installing on Nginx
121116
to create a new folder underneath the Nginx directory (typically
122117
/usr/local/nginx/conf/). Often this folder
123118
is called 'owasp-modsecurity-crs'. Create this folder and cd into it.
124-
4. Clone the repository into the current folder using:
125-
```git clone https://github.com/SpiderLabs/owasp-modsecurity-crs .```
119+
4. Download our release from https://coreruleset.org/installation/
120+
and unpack it into a new owasp-modsecurity-crs folder.
126121
5. Move the crs-setup.conf.example file to crs-setup.conf.
127122
Please take this time to go through this
128123
file and customize the settings for your local environment. Failure to
@@ -147,6 +142,12 @@ Installing on Nginx
147142
include owasp-modsecurity-crs/crs-setup.conf
148143
include owasp-modsecurity-crs/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf
149144
include owasp-modsecurity-crs/rules/REQUEST-901-INITIALIZATION.conf
145+
include owasp-modsecurity-crs/rules/REQUEST-903.9001-DRUPAL-EXCLUSION-RULES.conf
146+
include owasp-modsecurity-crs/rules/REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf
147+
include owasp-modsecurity-crs/rules/REQUEST-903.9003-NEXTCLOUD-EXCLUSION-RULES.conf
148+
include owasp-modsecurity-crs/rules/REQUEST-903.9004-DOKUWIKI-EXCLUSION-RULES.conf
149+
include owasp-modsecurity-crs/rules/REQUEST-903.9005-CPANEL-EXCLUSION-RULES.conf
150+
include owasp-modsecurity-crs/rules/REQUEST-903.9006-XENFORO-EXCLUSION-RULES.conf
150151
include owasp-modsecurity-crs/rules/REQUEST-905-COMMON-EXCEPTIONS.conf
151152
include owasp-modsecurity-crs/rules/REQUEST-910-IP-REPUTATION.conf
152153
include owasp-modsecurity-crs/rules/REQUEST-911-METHOD-ENFORCEMENT.conf
@@ -158,9 +159,11 @@ Installing on Nginx
158159
include owasp-modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf
159160
include owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf
160161
include owasp-modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
162+
include owasp-modsecurity-crs/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf
161163
include owasp-modsecurity-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
162164
include owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
163165
include owasp-modsecurity-crs/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf
166+
include owasp-modsecurity-crs/rules/REQUEST-933-APPLICATION-ATTACK-JAVA.conf
164167
include owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf
165168
include owasp-modsecurity-crs/rules/RESPONSE-950-DATA-LEAKAGES.conf
166169
include owasp-modsecurity-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf
@@ -181,8 +184,8 @@ Installing on IIS
181184
To upgrade or install this after the fact follow the following
182185
steps.
183186
1. Navigate to "[drive_letters]:\Program Files\ModSecurity IIS\"
184-
2. Clone the repository into the current folder using:
185-
```git clone https://github.com/SpiderLabs/owasp-modsecurity-crs```
187+
2. Download our release from https://coreruleset.org/installation/
188+
and unpack it into the current folder.
186189
3. Move the crs-setup.conf.example file to crs-setup.conf.
187190
Please take this time to go through this
188191
file and customize the settings for your local environment. Failure to
@@ -290,16 +293,7 @@ OWASP CRS Configuration
290293
Make sure your GeoIP and Project Honeypot settings are specified
291294
if you are using them.
292295
The GeoIP database is no longer included with the CRS. Instead
293-
you are advised to download it regularly. The script
294-
util/upgrade.py brings this functionality. You can use it as
295-
follows in cron:
296-
297-
```
298-
0 2 * * * util/upgrade.py --geoip --cron
299-
300-
```
301-
The use of the option --cron guarantees that the GeoIP
302-
download server is not hammered.
296+
you are advised to download it regularly.
303297

304298
The use of Project Honeypot requires a
305299
free API key. These require an account but can be obtained at

‎rules/REQUEST-903.9006-XENFORO-EXCLUSION-RULES.conf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,6 @@ SecRule REQUEST_FILENAME "@rx /(?:account/avatar|attachments/upload)$" \
189189
t:none,\
190190
nolog,\
191191
ctl:ruleRemoveById=200003,\
192-
ctl:ruleRemoveById=920150,\
193192
ctl:ruleRemoveTargetById=942220;ARGS:flowChunkSize,\
194193
ctl:ruleRemoveTargetById=942440;ARGS:flowIdentifier,\
195194
ctl:ruleRemoveTargetById=942440;ARGS:flowFilename,\

‎rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -487,7 +487,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F
487487
phase:2,\
488488
block,\
489489
capture,\
490-
t:none,t:urlDecode,t:replaceComments,t:compressWhiteSpace,\
490+
t:none,t:urlDecode,t:replaceComments,t:compressWhitespace,\
491491
msg:'PHP Injection Attack: Variable Function Call Found',\
492492
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
493493
tag:'application-multi',\

‎rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
6464
ver:'OWASP_CRS/3.2.0',\
6565
severity:'CRITICAL',\
6666
multiMatch,\
67-
setvar:'tx.rce_injection_score=+%{tx.critical_anomaly_score}',\
67+
setvar:'tx.rce_score=+%{tx.critical_anomaly_score}',\
6868
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
6969

7070

‎rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -883,7 +883,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU
883883
phase:2,\
884884
block,\
885885
capture,\
886-
t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,\
886+
t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhitespace,\
887887
msg:'IE XSS Filters - Attack Detected.',\
888888
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
889889
tag:'application-multi',\
@@ -911,7 +911,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU
911911
phase:2,\
912912
block,\
913913
capture,\
914-
t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhiteSpace,\
914+
t:none,t:urlDecodeUni,t:htmlEntityDecode,t:compressWhitespace,\
915915
msg:'IE XSS Filters - Attack Detected.',\
916916
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
917917
tag:'application-multi',\
@@ -964,7 +964,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
964964
ver:'OWASP_CRS/3.2.0',\
965965
severity:'CRITICAL',\
966966
setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
967-
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
967+
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
968968

969969

970970

‎rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1379,7 +1379,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
13791379
ver:'OWASP_CRS/3.2.0',\
13801380
severity:'CRITICAL',\
13811381
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
1382-
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
1382+
setvar:'tx.anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
13831383

13841384

13851385
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:942015,phase:1,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
@@ -1646,7 +1646,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
16461646
ver:'OWASP_CRS/3.2.0',\
16471647
severity:'CRITICAL',\
16481648
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
1649-
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
1649+
setvar:'tx.anomaly_score_pl3=+%{tx.critical_anomaly_score}'"
16501650

16511651
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:942017,phase:1,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
16521652
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 4" "id:942018,phase:2,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"

‎rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
4343
tag:'platform-multi',\
4444
tag:'attack-rce',\
4545
tag:'OWASP_CRS',\
46-
tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\
46+
tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\
4747
tag:'WASCTC/WASC-31',\
4848
tag:'OWASP_TOP_10/A1',\
4949
tag:'PCI/6.5.2',\
@@ -79,7 +79,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
7979
tag:'platform-multi',\
8080
tag:'attack-rce',\
8181
tag:'OWASP_CRS',\
82-
tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\
82+
tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\
8383
tag:'WASCTC/WASC-31',\
8484
tag:'OWASP_TOP_10/A1',\
8585
tag:'PCI/6.5.2',\
@@ -107,7 +107,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
107107
tag:'platform-multi',\
108108
tag:'attack-rce',\
109109
tag:'OWASP_CRS',\
110-
tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\
110+
tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\
111111
tag:'WASCTC/WASC-31',\
112112
tag:'OWASP_TOP_10/A1',\
113113
tag:'PCI/6.5.2',\
@@ -143,7 +143,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
143143
tag:'platform-multi',\
144144
tag:'attack-rce',\
145145
tag:'OWASP_CRS',\
146-
tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\
146+
tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\
147147
tag:'WASCTC/WASC-31',\
148148
tag:'OWASP_TOP_10/A1',\
149149
tag:'PCI/6.5.2',\
@@ -184,7 +184,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
184184
tag:'platform-multi',\
185185
tag:'attack-rce',\
186186
tag:'OWASP_CRS',\
187-
tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\
187+
tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\
188188
tag:'WASCTC/WASC-31',\
189189
tag:'OWASP_TOP_10/A1',\
190190
tag:'PCI/6.5.2',\
@@ -208,7 +208,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
208208
tag:'platform-multi',\
209209
tag:'attack-rce',\
210210
tag:'OWASP_CRS',\
211-
tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\
211+
tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\
212212
tag:'WASCTC/WASC-31',\
213213
tag:'OWASP_TOP_10/A1',\
214214
tag:'PCI/6.5.2',\
@@ -232,7 +232,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
232232
tag:'platform-multi',\
233233
tag:'attack-rce',\
234234
tag:'OWASP_CRS',\
235-
tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\
235+
tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\
236236
tag:'WASCTC/WASC-31',\
237237
tag:'OWASP_TOP_10/A1',\
238238
tag:'PCI/6.5.2',\
@@ -259,7 +259,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
259259
tag:'platform-multi',\
260260
tag:'attack-rce',\
261261
tag:'OWASP_CRS',\
262-
tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\
262+
tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\
263263
tag:'WASCTC/WASC-31',\
264264
tag:'OWASP_TOP_10/A1',\
265265
tag:'PCI/6.5.2',\
@@ -297,7 +297,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
297297
tag:'platform-multi',\
298298
tag:'attack-rce',\
299299
tag:'OWASP_CRS',\
300-
tag:'OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION',\
300+
tag:'OWASP_CRS/WEB_ATTACK/JAVA_INJECTION',\
301301
tag:'WASCTC/WASC-31',\
302302
tag:'OWASP_TOP_10/A1',\
303303
tag:'PCI/6.5.2',\

‎rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ SecRule RESPONSE_BODY "@rx <\?(?!xml)" \
103103
ver:'OWASP_CRS/3.2.0',\
104104
severity:'ERROR',\
105105
chain"
106-
SecRule RESPONSE_BODY "!@rx (?:\x1f\x8b\x08|\b(?:(?:i(?:nterplay|hdr|d3)|m(?:ovi|thd)|r(?:ar!|iff)|(?:ex|jf)if|f(?:lv|ws)|varg|cws)\b|gif)|B(?:%pdf|\.ra)\b)" \
106+
SecRule RESPONSE_BODY "!@rx (?:\x1f\x8b\x08|\b(?:(?:i(?:nterplay|hdr|d3)|m(?:ovi|thd)|r(?:ar!|iff)|(?:ex|jf)if|f(?:lv|ws)|varg|cws)\b|gif)|B(?:%pdf|\.ra)\b|^wOF(?:F|2))" \
107107
"capture,\
108108
t:none,\
109109
setvar:'tx.outbound_anomaly_score_pl1=+%{tx.error_anomaly_score}',\

0 commit comments

Comments
 (0)