Quotation Mark Formatting in ModSecurity Logs: Is the Use of Backticks and Single Quotes Correct?
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
首先，使用 ModSecurity v3.0.14、nginx connector 和 OWASP CRS v4.14.0 重现所引用的 AuditLogs 输出，然后检查日志格式化实现和现有测试。完成标准是确定混合使用反引号和单引号的格式是否出于有意；如果不正确，则定义预期格式，并通过回归测试覆盖它。
由索引模型根据 Issue 内容生成。
描述
Describe the bug
The ModSecurity log entries show operators and parameters enclosed in backticks (`), while variable names and data values are enclosed in single quotes ('). For example:
- `
PmFromFile' - `
lfi-os-files.data' - `
ARGS:bar' - `
/bin/sh'
and so on...
Wouldn't it have to be?
'PmFromFile''lfi-os-files.data''ARGS:bar''/bin/sh'
Logs and dumps
Output of: AuditLogs
---ABgEnRQg---H--
ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `lfi-os-files.data' against variable `ARGS:foo' (Value: `/etc/passwd' ) [file "/usr/share/owasp-modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "99"] [id "930120"] [rev ""] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:foo: /etc/passwd"] [severity "2"] [ver "OWASP_CRS/4.14.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language- multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "192.168.1.35"] [uri "/"] [unique_id "174622258411. 325032"] [ref "o1,10v10,11t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin"]
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[\x5c]*(?:(?:(?:\|\||&&)[\s\x0b]*)?\$[!#\(\*\-0-9\?@_a-\{]*)?\x5c?u[\"'\)\[\x5c]*(?:(?:(?:\|\||&&)[\s\x0b]*)?\$[!#\(\*\-0-9\?@_a-\{]*)?\x5c?s[\"'\)\[\x5c]*(?:(?: (?:\|\||&&)[\s\x0b]*)? (7133 characters omitted)' against variable `ARGS:bar' (Value: `/bin/sh' ) [file "/usr/share/owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "467"] [id "932250"] [rev ""] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: /bin/sh found within ARGS:bar: /bin/sh"] [severity "2"] [ver "OWASP_CRS/4.14.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-RCE"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "192.168.1.35"] [uri "/"] [unique_id "174622258411.325032"] [ref "o0,7v26,7"]
ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `unix-shell.data' against variable `ARGS:bar' (Value: `/bin/sh' ) [file "/usr/share/owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "606"] [id "932160"] [rev ""] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: bin/sh found within ARGS:bar: /bin/sh"] [severity "2"] [ver "OWASP_CRS/4.14.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-RCE"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "192.168.1.35"] [uri "/"] [unique_id "174622258411.325032"] [ref "o1,10v10,11t:cmdLine,t:normalizePatho1,6v26,7t:cmdLine,t:normalizePath"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `20' ) [file "/usr/share/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.14.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "192.168.1.35"] [uri "/"] [unique_id "174622258411.325032"] [ref ""]
To Reproduce
- None
Expected behavior
- To know if this behavior is correct.
Server (please complete the following information):
- ModSecurity v3.0.14 with nginx-connector v1.0.3
- WebServer: nginx/1.28.0
- OS: Ubuntu 24.04.2 LTS
Rule Set (please complete the following information):
- OWASP CRS v4.14.0
Additional context
None, just see logs.
- 主要语言
- C++
- 星标
- 9.8k
- 派生
- 1.8k
- 平均合并
- 1 天 2 小时
- 30 天内合并 PR
- 17
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
owasp-modsecurity/ModSecurity 的其他 Issue
-
3.x bug
难度 2/5 1-3 小时 新手友好度 78/100
owasp-modsecurity/ModSecurity#3708 ·
维护者通常 1 天内回复
-
v2: t:utf8toUnicode drops the last hex digit of code points above U+FFFF (regression since 2.9.9)未关闭
难度 2/5 1-3 小时 新手友好度 78/100
owasp-modsecurity/ModSecurity#3684 ·
维护者通常 1 天内回复
-
2.x bug Platform - IIS pr available windows
难度 1/5 1 小时以内 新手友好度 90/100
owasp-modsecurity/ModSecurity#3623 · 2 条评论 ·
维护者通常 1 天内回复
-
2.x bug Platform - IIS pr available windows
难度 2/5 1-3 小时 新手友好度 82/100
owasp-modsecurity/ModSecurity#3621 · 2 条评论 ·
维护者通常 1 天内回复
-
2.x bug Platform - IIS pr available windows
难度 2/5 1-3 小时 新手友好度 84/100
owasp-modsecurity/ModSecurity#3619 · 2 条评论 ·
维护者通常 1 天内回复
查看 owasp-modsecurity/ModSecurity 的全部 Issue
相似的 Issue
-
Status: Needs confirmation Status: Needs triage
难度 2/5 1-3 小时 新手友好度 64/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
boykopovar/AnyPS5#12124 ·
维护者通常 1 天内回复
-
bug-unconfirmed
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
维护者通常 1 天内回复
-
A-combat P-low S-ready-to-start task
难度 2/5 1-3 小时 新手友好度 77/100
维护者通常 1 天内回复