Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Improve XML External Entity (XXE) detection

オープン
  • 何か問題がありますか？
#47 コメント 63 件 リアクション 3 件 担当者 1 名 GitHub で見る

@azurit がすでに取り組んでいます。

2024年4月27日 から。

評価

この issue はまだ評価されていません。

説明

Motivation

I could be wrong but as far as I can tell, the XML External Entity (XXE) protection offered by CRS is fairly poor. There have been multiple attempts in the past to address these shortcomings but they have not succeeded and there are currently no ongoing efforts to improve the situation.

These are the issues and pull requests that have been created in the past:

From the discussions in the tickets and pull requests above, the problem appears to be that there is a shortcoming of ModSecurtiy which causes the targeted collections (REQUEST_BODY and FULL_REQUEST) to be empty if a body parser has been activated. This, of course, would be the case in most situation where XXE detection is desired, braking the proposed rules.

However, since the information related to XXEs is contained in <!DOCTYPE ...> tags, which are not accessible through the XML collection using XPath expressions, is not possible to write reliable ModSecurity rules to detect XXEs for these requests.

This issue is known but considering the following discussion, it is unlikely to be fixed in ModSecurity any time soon: https://github.com/SpiderLabs/ModSecurity/issues/2087.

There have been comments that a plugin leveraging ModSecurity's Lua capabilities might help but as far as I can tell, this was never implemented: https://github.com/coreruleset/coreruleset/pull/2163#issuecomment-997432471.

Proposed solution

Implement a plugin similar to the antivirus plugin which can reliably detect XXEs in requests independently of whether or not a body parser has been activated.

Alternatives

A cleaner approach might be to create a pull request to ModSecurity to provide additional information about the payload like the DOCTYPE through either the existing XML collection or through a new collection. This would allow for regular rules to be written in order to detect XXEs. However, this would require a change to ModSecurity, which is outside the control of the Core Rule Set Project.

Additional context

There is a ModSecurity directive related to XXEs: SecXmlExternalEntity. This directive is turned off by default. From what I understand, this directive only configures whether ModSec expands External Entities in XML or not. It does not configure whether XXEs are allowed in general or not. XML containing XXEs are not blocked, even if SecXmlExternalEntity is turned off.

There are rules that might detect XXEs in certain circumstances, however, this is mostly incidental as they do not explicitly check for XXEs.

主要言語
Python
スター
53
フォーク
13
平均マージ
7時間 30分
マージ済み PR（30日）
1

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

coreruleset/plugin-registry のほかの issue

coreruleset/plugin-registry の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。