0

I have an application served by Apache, on which mod_security is enabled, and I have been successfully tuning exceptions to avoid false positives using the likes of:

SecRuleUpdateTargetById 981260 !ARGS:'/^PD-.*/'

But now I am facing the case where a request argument carries a password, which could potentially contain every possible combination of characters that mod_security will flag as false positive. So my naive solution would be to disable all rules for that particular argument with something like:

SecRuleUpdateTargetById * !ARGS:'/^PD-.*/'

Is such a thing possible?

NotSoOldNick
  • 103
  • 3

1 Answers1

3

No that's not possible. Though it is possible to disable multiple rules at a time based on a tag id so all rules tagged with that tag are disabled, for example:

SecRuleUpdateTargetByTag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION" !ARGS:'/^PD-.*/'

If an argument potentially falls foul of several different tags of rules (e.g. SQL injection and XSS) then you will have to put in several SecRuleUpdateTargetByTag exceptions.

This also depends on tags being specified consistently in the rule set. They mostly are in the OWASP CRS but not sure about other ModSecurity rule sets.

See here for more details: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#SecRuleUpdateTargetByTag

You can similarly use SecRuleUpdateTargetByMsg instead (https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#SecRuleUpdateTargetByMsg)

Barry Pollard
  • 4,461
  • 14
  • 26