Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: replacing t:UrlDecode with t:UrlDecodeUni (921240 PL1, 932170 PL1, 932171 PL1, 932190 PL3, 932190 PL1, 933211 PL3, 941310 PL1, 941350 PL1) #3713

Merged
merged 4 commits into from
Jun 18, 2024
Merged

fix: replacing t:UrlDecode with t:UrlDecodeUni (921240 PL1, 932170 PL1, 932171 PL1, 932190 PL3, 932190 PL1, 933211 PL3, 941310 PL1, 941350 PL1) #3713

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7d6fd91
Replacing UrlDecode with UrlDecodeUni
azurit May 23, 2024
86169e7
Typo
azurit May 23, 2024
ae7d01d
Merge branch 'main' into UrlDecodeUni
azurit May 26, 2024
d8accb5
Merge branch 'main' into UrlDecodeUni
azurit Jun 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion rules/REQUEST-921-PROTOCOL-ATTACK.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -290,7 +290,7 @@ SecRule REQUEST_URI "@rx unix:[^|]*\|" \
phase:1,\
block,\
capture,\
t:none,t:urlDecode,t:lowercase,\
t:none,t:urlDecodeUni,t:lowercase,\
msg:'mod_proxy attack attempt detected',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
tag:'application-multi',\
Expand Down
6 changes: 3 additions & 3 deletions rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -589,7 +589,7 @@ SecRule REQUEST_HEADERS|REQUEST_LINE "@rx ^\(\s*\)\s+{" \
phase:1,\
block,\
capture,\
t:none,t:urlDecode,\
t:none,t:urlDecodeUni,\
msg:'Remote Command Execution: Shellshock (CVE-2014-6271)',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
tag:'application-multi',\
Expand All @@ -610,7 +610,7 @@ SecRule ARGS_NAMES|ARGS|FILES_NAMES "@rx ^\(\s*\)\s+{" \
phase:2,\
block,\
capture,\
t:none,t:urlDecode,t:urlDecodeUni,\
t:none,t:urlDecodeUni,\
theseion marked this conversation as resolved.
Show resolved Hide resolved
msg:'Remote Command Execution: Shellshock (CVE-2014-6271)',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
tag:'application-multi',\
Expand Down Expand Up @@ -1670,7 +1670,7 @@ SecRule ARGS "@rx /(?:[?*]+[a-z/]+|[a-z/]+[?*]+)" \
phase:2,\
block,\
capture,\
t:none,t:urlDecode,t:urlDecodeUni,t:normalizePath,t:cmdLine,\
theseion marked this conversation as resolved.
Show resolved Hide resolved
t:none,t:urlDecodeUni,t:normalizePath,t:cmdLine,\
msg:'Remote Command Execution: Wildcard bypass technique attempt',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
tag:'application-multi',\
Expand Down
4 changes: 2 additions & 2 deletions rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -493,7 +493,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F
phase:2,\
block,\
capture,\
t:none,t:urlDecode,t:replaceComments,t:removeWhitespace,\
t:none,t:urlDecodeUni,t:replaceComments,t:removeWhitespace,\
msg:'PHP Injection Attack: Variable Function Call Found',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
tag:'application-multi',\
Expand Down Expand Up @@ -744,7 +744,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_F
phase:2,\
block,\
capture,\
t:none,t:urlDecode,t:replaceComments,t:removeWhitespace,\
t:none,t:urlDecodeUni,t:replaceComments,t:removeWhitespace,\
msg:'PHP Injection Attack: Variable Function Call Found',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
tag:'application-multi',\
Expand Down
4 changes: 2 additions & 2 deletions rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -583,7 +583,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
phase:2,\
block,\
capture,\
t:none,t:lowercase,t:urlDecode,t:htmlEntityDecode,t:jsDecode,\
t:none,t:lowercase,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,\
msg:'US-ASCII Malformed Encoding XSS Filter - Attack Detected',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
tag:'application-multi',\
Expand Down Expand Up @@ -612,7 +612,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
phase:2,\
block,\
capture,\
t:none,t:urlDecode,t:htmlEntityDecode,t:jsDecode,\
t:none,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,\
msg:'UTF-7 Encoding IE XSS - Attack Detected',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
tag:'application-multi',\
Expand Down