Skip to content

Commit ca0e571

Browse files
airweenairween
authored
Merge pull request #34 from Sebitosh/request-filename
Test: 061 - target REQUEST_FILENAME - recreation of CVE-2024-1019
2 parents b523859 + 012e852 commit ca0e571

11 files changed

+464
-16
lines changed

‎config_tests/CONF_061_TARGET_REQUEST_FILENAME.yaml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
target: REQUEST_FILENAME
2+
rulefile: MRTS_061_REQUEST_FILENAME.conf
3+
testfile: MRTS_061_REQUEST_FILENAME.yaml
4+
templates:
5+
- SecRule for TARGETS
6+
colkey:
7+
- - ''
8+
operator:
9+
- '@contains'
10+
oparg:
11+
- attack
12+
phase:
13+
- 1
14+
- 2
15+
- 3
16+
- 4
17+
testdata:
18+
phase_methods:
19+
1: get
20+
2: post
21+
3: post
22+
4: post
23+
targets:
24+
- target: ''
25+
test:
26+
data: null
27+
input:
28+
uri: '/in/uri/attack?arg=value'
29+
- target: ''
30+
test:
31+
data: null
32+
input:
33+
uri: '/attack/in/uri?arg=value'
34+
- target: ''
35+
test:
36+
data: null
37+
input:
38+
uri: '/in/uri/is%3Fattack?arg=value'
39+
- target: ''
40+
test:
41+
data: null
42+
input:
43+
uri: '/in/uri/is?attack'
44+
output:
45+
log:
46+
no_expect_ids: []

‎generated/rules/MRTS_061_REQUEST_FILENAME.conf‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
SecRule REQUEST_FILENAME "@contains attack" \
2+
"id:100148,\
3+
phase:1,\
4+
deny,\
5+
t:none,\
6+
log,\
7+
msg:'%{MATCHED_VAR_NAME} was caught in phase:1',\
8+
ver:'MRTS/0.1'"
9+
10+
SecRule REQUEST_FILENAME "@contains attack" \
11+
"id:100149,\
12+
phase:2,\
13+
deny,\
14+
t:none,\
15+
log,\
16+
msg:'%{MATCHED_VAR_NAME} was caught in phase:2',\
17+
ver:'MRTS/0.1'"
18+
19+
SecRule REQUEST_FILENAME "@contains attack" \
20+
"id:100150,\
21+
phase:3,\
22+
deny,\
23+
t:none,\
24+
log,\
25+
msg:'%{MATCHED_VAR_NAME} was caught in phase:3',\
26+
ver:'MRTS/0.1'"
27+
28+
SecRule REQUEST_FILENAME "@contains attack" \
29+
"id:100151,\
30+
phase:4,\
31+
deny,\
32+
t:none,\
33+
log,\
34+
msg:'%{MATCHED_VAR_NAME} was caught in phase:4',\
35+
ver:'MRTS/0.1'"
36+

‎generated/rules/MRTS_110_XML.conf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
SecRule XML:/* "@beginsWith foo" \
2-
"id:100148,\
2+
"id:100152,\
33
phase:2,\
44
deny,\
55
t:none,\
@@ -8,7 +8,7 @@ SecRule XML:/* "@beginsWith foo" \
88
ver:'MRTS/0.1'"
99

1010
SecRule XML:/* "@beginsWith foo" \
11-
"id:100149,\
11+
"id:100153,\
1212
phase:3,\
1313
deny,\
1414
t:none,\
@@ -17,7 +17,7 @@ SecRule XML:/* "@beginsWith foo" \
1717
ver:'MRTS/0.1'"
1818

1919
SecRule XML:/* "@beginsWith foo" \
20-
"id:100150,\
20+
"id:100154,\
2121
phase:4,\
2222
deny,\
2323
t:none,\

‎generated/tests/regression/tests/100148_MRTS_061_REQUEST_FILENAME.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
meta:
3+
author: MRTS generate-rules.py
4+
enabled: true
5+
name: MRTS_061_REQUEST_FILENAME.yaml
6+
description: Desc
7+
tests:
8+
- test_title: 100148-1
9+
ruleid: 100148
10+
test_id: 1
11+
desc: 'Test case for rule 100148, #1'
12+
stages:
13+
- description: Send request
14+
input:
15+
dest_addr: 127.0.0.1
16+
port: 80
17+
protocol: http
18+
method: GET
19+
headers:
20+
User-Agent: OWASP MRTS test agent
21+
Host: localhost
22+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
23+
uri: /in/uri/attack?arg=value
24+
version: HTTP/1.1
25+
output:
26+
log:
27+
expect_ids:
28+
- 100148
29+
- test_title: 100148-2
30+
ruleid: 100148
31+
test_id: 2
32+
desc: 'Test case for rule 100148, #2'
33+
stages:
34+
- description: Send request
35+
input:
36+
dest_addr: 127.0.0.1
37+
port: 80
38+
protocol: http
39+
method: GET
40+
headers:
41+
User-Agent: OWASP MRTS test agent
42+
Host: localhost
43+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
44+
uri: /attack/in/uri?arg=value
45+
version: HTTP/1.1
46+
output:
47+
log:
48+
expect_ids:
49+
- 100148
50+
- test_title: 100148-3
51+
ruleid: 100148
52+
test_id: 3
53+
desc: 'Test case for rule 100148, #3'
54+
stages:
55+
- description: Send request
56+
input:
57+
dest_addr: 127.0.0.1
58+
port: 80
59+
protocol: http
60+
method: GET
61+
headers:
62+
User-Agent: OWASP MRTS test agent
63+
Host: localhost
64+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
65+
uri: /in/uri/is%3Fattack?arg=value
66+
version: HTTP/1.1
67+
output:
68+
log:
69+
expect_ids:
70+
- 100148
71+
- test_title: 100148-4
72+
ruleid: 100148
73+
test_id: 4
74+
desc: 'Test case for rule 100148, #4'
75+
stages:
76+
- description: Send request
77+
input:
78+
dest_addr: 127.0.0.1
79+
port: 80
80+
protocol: http
81+
method: GET
82+
headers:
83+
User-Agent: OWASP MRTS test agent
84+
Host: localhost
85+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
86+
uri: /in/uri/is?attack
87+
version: HTTP/1.1
88+
output:
89+
log:
90+
no_expect_ids:
91+
- 100148

‎generated/tests/regression/tests/100149_MRTS_061_REQUEST_FILENAME.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
meta:
3+
author: MRTS generate-rules.py
4+
enabled: true
5+
name: MRTS_061_REQUEST_FILENAME.yaml
6+
description: Desc
7+
tests:
8+
- test_title: 100149-1
9+
ruleid: 100149
10+
test_id: 1
11+
desc: 'Test case for rule 100149, #1'
12+
stages:
13+
- description: Send request
14+
input:
15+
dest_addr: 127.0.0.1
16+
port: 80
17+
protocol: http
18+
method: POST
19+
headers:
20+
User-Agent: OWASP MRTS test agent
21+
Host: localhost
22+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
23+
uri: /in/uri/attack?arg=value
24+
version: HTTP/1.1
25+
output:
26+
log:
27+
expect_ids:
28+
- 100149
29+
- test_title: 100149-2
30+
ruleid: 100149
31+
test_id: 2
32+
desc: 'Test case for rule 100149, #2'
33+
stages:
34+
- description: Send request
35+
input:
36+
dest_addr: 127.0.0.1
37+
port: 80
38+
protocol: http
39+
method: POST
40+
headers:
41+
User-Agent: OWASP MRTS test agent
42+
Host: localhost
43+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
44+
uri: /attack/in/uri?arg=value
45+
version: HTTP/1.1
46+
output:
47+
log:
48+
expect_ids:
49+
- 100149
50+
- test_title: 100149-3
51+
ruleid: 100149
52+
test_id: 3
53+
desc: 'Test case for rule 100149, #3'
54+
stages:
55+
- description: Send request
56+
input:
57+
dest_addr: 127.0.0.1
58+
port: 80
59+
protocol: http
60+
method: POST
61+
headers:
62+
User-Agent: OWASP MRTS test agent
63+
Host: localhost
64+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
65+
uri: /in/uri/is%3Fattack?arg=value
66+
version: HTTP/1.1
67+
output:
68+
log:
69+
expect_ids:
70+
- 100149
71+
- test_title: 100149-4
72+
ruleid: 100149
73+
test_id: 4
74+
desc: 'Test case for rule 100149, #4'
75+
stages:
76+
- description: Send request
77+
input:
78+
dest_addr: 127.0.0.1
79+
port: 80
80+
protocol: http
81+
method: POST
82+
headers:
83+
User-Agent: OWASP MRTS test agent
84+
Host: localhost
85+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
86+
uri: /in/uri/is?attack
87+
version: HTTP/1.1
88+
output:
89+
log:
90+
no_expect_ids:
91+
- 100149

‎generated/tests/regression/tests/100150_MRTS_061_REQUEST_FILENAME.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
---
2+
meta:
3+
author: MRTS generate-rules.py
4+
enabled: true
5+
name: MRTS_061_REQUEST_FILENAME.yaml
6+
description: Desc
7+
tests:
8+
- test_title: 100150-1
9+
ruleid: 100150
10+
test_id: 1
11+
desc: 'Test case for rule 100150, #1'
12+
stages:
13+
- description: Send request
14+
input:
15+
dest_addr: 127.0.0.1
16+
port: 80
17+
protocol: http
18+
method: POST
19+
headers:
20+
User-Agent: OWASP MRTS test agent
21+
Host: localhost
22+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
23+
uri: /in/uri/attack?arg=value
24+
version: HTTP/1.1
25+
output:
26+
log:
27+
expect_ids:
28+
- 100150
29+
- test_title: 100150-2
30+
ruleid: 100150
31+
test_id: 2
32+
desc: 'Test case for rule 100150, #2'
33+
stages:
34+
- description: Send request
35+
input:
36+
dest_addr: 127.0.0.1
37+
port: 80
38+
protocol: http
39+
method: POST
40+
headers:
41+
User-Agent: OWASP MRTS test agent
42+
Host: localhost
43+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
44+
uri: /attack/in/uri?arg=value
45+
version: HTTP/1.1
46+
output:
47+
log:
48+
expect_ids:
49+
- 100150
50+
- test_title: 100150-3
51+
ruleid: 100150
52+
test_id: 3
53+
desc: 'Test case for rule 100150, #3'
54+
stages:
55+
- description: Send request
56+
input:
57+
dest_addr: 127.0.0.1
58+
port: 80
59+
protocol: http
60+
method: POST
61+
headers:
62+
User-Agent: OWASP MRTS test agent
63+
Host: localhost
64+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
65+
uri: /in/uri/is%3Fattack?arg=value
66+
version: HTTP/1.1
67+
output:
68+
log:
69+
expect_ids:
70+
- 100150
71+
- test_title: 100150-4
72+
ruleid: 100150
73+
test_id: 4
74+
desc: 'Test case for rule 100150, #4'
75+
stages:
76+
- description: Send request
77+
input:
78+
dest_addr: 127.0.0.1
79+
port: 80
80+
protocol: http
81+
method: POST
82+
headers:
83+
User-Agent: OWASP MRTS test agent
84+
Host: localhost
85+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
86+
uri: /in/uri/is?attack
87+
version: HTTP/1.1
88+
output:
89+
log:
90+
no_expect_ids:
91+
- 100150

0 commit comments

Comments
 (0)