Monthly Chat Agenda November 2021 (2021-11-01 and 2021-11-15)

[dune73]

This is the Agenda for the Monthly CRS Chat.

The general chat is going to happen on https://owasp.slack.com in the channel #coreruleset on Monday, 2021-11-01, at 20:30 CET. That's the 1st Monday of the month. A separate issue chat is happening at the same location, same time on Monday, 2021-01-15. That's the 3rd Monday of the month. Please note that we have a CRS calendar (maintained by @fzipi).

Items on the Agenda: (see previous meetings decisions: here)

What happend in the meantime since the chat last month

Outside development

• Blog post about MySQL bug that is not being detected by AWS WAF, ModSec libjection but detected by CRS at PL2
• Google Dork List for SQLi in 2021
• Blog Post: Working with Paranoia Levels
• Blog Post: Looking back at Dev Retreat

More about dev retreat in the wiki:

• Retreat Infos: Infos for Participants
• Project: Update CRS Documentation
• Project: Write Technical Blog Posts
• Project: CRS Demo / Sandbox Site
• Project: CRS Status Page
• Project: Coraza Integration
• Workshop: How to Avoid CVEs in the Future
• Workshop: Project Planning Workshop
• Workshop: Trustwave Announcement about ModSecurity
• Workshop: Creating a Template to Document CRS Rules
• Workshop: New rules to defend against Request Smuggling and Server Side Request Forgery
• Workshop: What to do with ModSecurity Recommended Rules

PRs that have been merged since the last meeting

• fix ReDoS on 941140 #2050
• Add prefix, suffix, and comments to regexp assemble data files #2149
• fix: consistent backslash escaping #2183
• Added missing " from the end of actions list #2184
• Amend regular expression pattern for rule 942440 #2201
• feat(nightly): add nightly latest releases #2207
• 941101 add request filename #2208
• Don't cook hex escapes #2215
• Adding 'drop' keyword #2218
• Fix FP with Google Funding Choices cookies #2226
• fix(ci): remove tag before releasing #2231
• Aligned the actions into right order #2237
• Fixing docs for Apache #2238
• Fix Python version for tests to 3.9 #2247
• phpMyAdmin exclusion package update #2249
• .gitignore: add Go-FTW configuration file #2251
• Add pos and neg testcase for 942460 #2252
• Added test file for rule 913102 #2253
• Added test file for rule 942251 #2254
• Added test file for rule 942170 #2255
• Added test file for rule 913101 #2257
• docs: change submodule to new repo url #2260
• Correct Rule ID typos: 920120 to 930120 and 920121 to 930121 in REQUE… #2263
• Add pos and neg testcases for 932190 #2268
• Testcase932106 #2269
• Add positive and negative test for rule 921151 #2270
• Add Invoke-WebRequest to windows-powershell-commands.data #2271
• Add positive and negative tests for rule 932120 #2272
• Add positive and negative tests for rule 932130 #2273
• Add positive and negative tests for rule 932150 #2275
• Add positive and negative tests for rule 932160 #2276
• Add testfile 932180 #2280
• Add test cases #2281
• NextCloud example in comments fix #2282
• Add 1 pos testcase for 932170 #2283

We merged 35 PRs since the last monthly project chat. The number is exceptionally high due to the dev retreat, but also due to issue #2256 that aims to add tests for rules that are untested hitherto.

Open PRs

• Added new util script to find rules without test #2279
• Added new util script to find the longest data lenght in tests #2277
• ci: add PR template example #2274
• Fix capec for crawlers #2258
• Unified regexp-assemble toolchain #2223
• Fixing Google OAuth2 detection #2222

Open PRs related to issues 2256 (@2256)

• Add 2 positive testcases for 932171 #2284
• Test 921180 and 921170 #2267
• test: add tests for 920341 #2266
• test: add test 920171 #2265
• Add Tests for Rule 920121 #2264

Open PRs marked DRAFT or work in progress or needs action

• feat(ssrf): adds rules to check for IP based SSRF #2259
• fix(sql): update rule to remove false positive #2248
• Added crs-rules-check tool #2236
• Exclusion list fot RoundCube webmail #2217
• Fix 933210 Regex #2214
• Refactored and tested version of rule-ctl script #2193
• Replace NodeJS Rule Set #2163
• Detect JavaScript prototype pollution injection attempts #2070
• Proposal for a new plugin: Machine Learning on ModSecurity #2067
• Override modsec rule 200001 #2049
• Draft: Plugins support + response body decompress plugin #1993
• Nextcloud 20 false-positives #1975

Other items

• Looking through projects started during the dev retreat and hear about their status.

Open Issues - Separate Issues Meeting (Monday, 2021-11-15)

Intermediate Status:

• Documentation project: FIXME
• Technical blog posts project: FIXME
• Sandbox project: FIXME
• Status page project: FIXME

Status of issues covered last month

none - we did not do an issue chat in October.

This month's issues

There are 25 open issues at the beginning of the issue chat.

We generally cover 10 issues per month in a separate issue meeting. Add them as you see fit.

• Issue slot 1: Fake Googlebot plugin #2227 + Fake bot plugin #2228
• Issue slot 2: Add Windows triple dot to a PL1 rule #2205
• Issue slot 3: Idea: Adaptive paranoia level #2240 - proposal for a dynamic PL based on reputation of request / IP (maybe via plugin)
• Issue slot 4: Unable to access a user's post PHPBB 3.3.3 #2150 - we have a solution, but unsure about the impact. Let's discuss.
• Issue slot 5: New PL2/3 rule that catches mail (SMTP) injections #2206 - SMTP and friends should be covered. We have a proposal.
• Issue slot 6: Add exclusion set for OData standard #2127 - We need a volunteer for a rule exclusion set on OData.
• Issue slot 7: Google OAuth2 plugin #2232 - Question of working OAuth2 FP workarounds into a plugin instead of blowing up rules with highly specific chains
• Issue slot 8: Plugins: Config file is not loaded before rules #2246 - plugin question
• Issue slot 9: #FIXME
• Issue slot 10: #FIXME

How to get to our slack and join the meeting?

If you are not yet on the OWASP Slack, here is your invite: https://owasp-slack.herokuapp.com/ .

Everybody is welcome to join our community chat.

[franbuehler]

Decisions

PRs

• Added new util script to find rules without test #2279 - @franbuehler will review it
• Added new util script to find the longest data lenght in tests #2277 - @franbuehler will review it
• ci: add PR template example #2274- Paul and @RedXanadu will with @fzipi to get this merged
• Fix capec for crawlers #2258 - Keep this open for a few days. Maybe @fzipi has more to add. If not: rm the CAPEC tag
• Unified regexp-assemble toolchain #2223 - Ready to be merged. @RedXanadu will merge
• Fixing Google OAuth2 detection #2222 - There are also other optional arguments in OAuth2 documentation, which are not covered by this PR. @azurit will open an issue to look at this carefully, maybe do it as plugin - and then we review this PR and merge it. That way we don't forget it and the PR gets off the queue.

Dev retreat topics

• Documentation: @RedXanadu and @lifeforms laid the foundation for the new documentation. They will continue their work. Perhaps sourcing from the rest of the team.
• Technical blog posts: @dune73 will continue on this
• Demo / Sandbox site: is almost presentable. @fzipi wants to take a closer look at the setup so we do not open up any vulnerabilities. Afterwards, we could release this - and then look at more features with a mid-term horizon. @theMiddleBlue will also work on this. Project board link
• Status page: @fzipi: cloud providers invoice problem and setup. @airween: look at go-ftw and what we need there.
• Coraza: @fzipi and @dune73 will keep in touch with lead dev Juan Pablo.

Issues

• Issue slot 1: Fake Googlebot plugin #2227 + Fake bot plugin #2228 - @azurit would like to combine both into a plugin
• Issue slot 2: Add Windows triple dot to a PL1 rule #2205 - @RedXanadu volunteers to review both PRs
• Issue slot 3: Idea: Adaptive paranoia level #2240 - proposal for a dynamic PL based on reputation of request / IP - we agree on this to be a plugin that also covers setting the executive PL
• Issue slot 4: Unable to access a user's post PHPBB 3.3.3 #2150 - @azurit will provide a PR
• Issue slot 5: New PL2/3 rule that catches mail (SMTP) injections #2206 - @fzipi will write the rule and provide a PR
• Issue slot 6: Add exclusion set for OData standard #2127 - we leave this open
• Issue slot 7: Google OAuth2 plugin #2232 - Question of working OAuth2 FP workarounds into a plugin instead of blowing up rules with highly specific chains - yes, this will go into a plugin
• Issue slot 8: Plugins: Config file is not loaded before rules #2246 - plugin question - @airween and @franbuehler will join the discussion between @azurit and @dune73 in the coming days.
• Issue slot 9: #FIXME
• Issue slot 10: #FIXME