Blog – Page 2 – OWASP ModSecurity Core Rule Set

OWASP ModSecurity Core Rule Set v3.3.0 Release Candidate 2 available

By Walter Hop / June 18, 2020 June 18, 2020

The OWASP ModSecurity Core Rule Set team is proud to announce the release candidate 2 for the upcoming CRS v3.3.0 release. The release candidate is available at: https://github.com/coreruleset/coreruleset/archive/v3.3.0-rc2.tar.gz https://github.com/coreruleset/coreruleset/archive/v3.3.0-rc2.zip This release packages many changes, such as: Block backup files ending with ~ in filename (Andrea Menin) Detect ffuf vuln scanner (Will Woodson) Detect SemrushBot crawler …

OWASP ModSecurity Core Rule Set v3.3.0 Release Candidate 2 available Read More »

Overhauling the CRS Tags

By Christian Folini / June 8, 2020 June 8, 2020

Tagging rules is a great feature of ModSecurity since it allows you to add information to your ModSec alert messages. In my tutorial on Embedding ModSec over at netnea.com, I use the tag feature in the default action to add a tag to every alert message from a given service. I do this as follows: …

Overhauling the CRS Tags Read More »

CRS Repository at New Location

By Christian Folini / May 13, 2020 May 14, 2020

We have successfully migrated our GitHub repository to a new location at https://github.com/coreruleset/coreruleset Trustwave SpiderLabs hosted the OWASP ModSecurity Core Rule Set project under their umbrella for many years. They acted as stewards of our project and also directed it via the former lead Ryan Barnett. Yet as a formally independent OWASP project, it is …

CRS Repository at New Location Read More »

CVE-2019-19886 – HIGH – DoS against libModSecurity 3

By Christian Folini / January 18, 2020 February 21, 2020

The ModSecurity 3.0.x release line suffers from a Denial of Service vulnerability after triggering a segmentation fault on the webserver when parsing a malformed cookie header. All users of ModSecurity 3.0.0 – 3.0.3 should update to ModSecurity 3.0.4 as soon as possible. ModSecurity 2.x is not affected. The CVSS score for the vulnerability is 7.5 …

CVE-2019-19886 – HIGH – DoS against libModSecurity 3 Read More »

CRS Project News January 2020

By Christian Folini / January 14, 2020 January 18, 2020

It’s been a while since the last CRS project news. It’s not because there was nothing to report. It’s more like too much going on and no time to sit back and write it all down. Here are the most important things that happened since the last edition: ModSecurity 3.0.4 has been released for NGINX. …

CRS Project News January 2020 Read More »

Running a few dozens of new magic XSS payloads against CRS 3.2

By Christian Folini / September 26, 2019 September 28, 2019

Earlier today, Gareth Heyes presented a very interesting talk with dozens of new XSS payloads at the OWASP GlobalAppSec conference in Amsterdam. The CRS developers in the audience immediately started to try out the payloads, but Gareth was so quick they lost track… But being the helpful person he is, he published the slides during …

Running a few dozens of new magic XSS payloads against CRS 3.2 Read More »

Announcement: OWASP ModSecurity Core Rule Set Version 3.2.0

By Walter Hop / September 24, 2019 September 24, 2019

The OWASP ModSecurity Core Rule Set team is proud to announce the general availability of the OWASP ModSecurity Core Rule Set Version 3.2.0. The new release is available for download at https://coreruleset.org/installation/ This release represents a very big step forward in terms of both capabilities and protections including: Improved compatibility with ModSecurity 3.x Improved CRS …

Announcement: OWASP ModSecurity Core Rule Set Version 3.2.0 Read More »

How the CRS protects the vulnerable web application Pixi by OWASP DevSlop

By Franziska Buehler / September 9, 2019 September 12, 2019

How could the functionality of a WAF be better demonstrated than with a vulnerable web application? In this blog post I introduce Pixi, an intentionally vulnerable web application by the OWASP project DevSlop. I show its known vulnerabilities and examine how the CRS protects against these vulnerabilities. What is Pixi? Pixi is a deliberately vulnerable …

How the CRS protects the vulnerable web application Pixi by OWASP DevSlop Read More »

Announcement: OWASP ModSecurity Core Rule Set Version 3.2.0-RC2

By Walter Hop / September 3, 2019 September 3, 2019

The OWASP ModSecurity Core Rule Set team is proud to announce the general availability of release candidate 2 for the upcoming CRS v3.2.0. The new release is available at https://github.com/coreruleset/coreruleset/archive/v3.2.0-rc2.zip https://github.com/coreruleset/coreruleset/archive/v3.2.0-rc2.tar.gz This release represents a very big step forward in terms of both capabilities and protections including: Improved compatibility with ModSecurity 3.x Improved CRS docker …

Announcement: OWASP ModSecurity Core Rule Set Version 3.2.0-RC2 Read More »

How the CRS optimizes regular expressions

By Walter Hop / August 26, 2019 August 26, 2019

As many of you have noticed, the Core Rule Set contains very complex regular expressions. See for example rule 942480: (?i:(?:\b(?:(?:s(?:elect\b.{1,100}?\b(?:(?:(?:length|count)\b.{1,100}?|.*?\bdump\b.*)\bfrom|to(?:p\b.{1,100}?\bfrom|_(?:numbe|cha)r)|(?:from\b.{1,100}?\bwher|data_typ)e|instr)|ys_context)|in(?:to\b\W*?\b(?:dump|out)file|sert\b\W*?\binto|ner\b\W*?\bjoin)|… These regular expressions are assembled from a list of simpler regular expressions for efficiency reasons. See regexp-942480.data for the source expressions which were combined to form this expression. A single optimized regular expression test …

How the CRS optimizes regular expressions Read More »