1

I've just installed CRS for Apache mod_security and it's reporting all PDF files as possible attacks. Specificaly, it's the modsecurity_crs_20_protocol_violations.conf that's causing the trouble saying those files begin with 0.

When a user tries to download any PDF file I get this log (domain name changed):

[Tue Jul 08 15:02:40.695235 2014] [ratelimit:error] [pid 6875:tid 140072931452672]
[client 149.255.82.154:57722] AH01457: rl: brigade pass failed., referer: 
http://example.com/downloads/
[Tue Jul 08 15:02:41.081811 2014] [:error] [pid 6875:tid 140072923059968] [client 
149.255.82.154] ModSecurity: Warning. String match "bytes=0-" at 
REQUEST_HEADERS:Range. [file "/etc/httpd/crs/activated_rules
/modsecurity_crs_20_protocol_violations.conf"] [line "428"] [id "958291"] [rev "2"] 
[msg "Range: field exists and begins with 0."] [data "bytes=0-65535"] [severity 
"WARNING"] [ver "OWASP_CRS/2.2.9"] [maturity "6"] [accuracy "8"] [tag 
"OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "example.com"] [uri 
"/app/files/broz_pd.pdf"] [unique_id "U7vr8X8AAAEAABrbRKQAAACB"]

I tried to whitelist PDF files by creating a modsecurity_15_whitelist.conf and adding this:

SecRule ".*\.pdf$" "phase:1,id:158963,t:none,nolog,noauditlog,pass"

(and restarting Apache) with no success.

Could anyone help me to get rid of these false positives?

masegaloeh
  • 17,978
  • 9
  • 56
  • 104
Petr
  • 11
  • 3

1 Answers1

0

Add this line on /etc/modsecurity/modsecurity.conf file and restart apache.

SecRule REQUEST_URI ".*\.(pdf|jpeg|png|xml)\?$" "phase:1,id:1001,nolog,t:urlDecode,t:lowercase,t:normalizePath,ctl:ruleRemoveById=958291"

Thusitha Sumanadasa
  • 103
  • 4