Mod_Security Wordpress False Positives

I am rather new to Mod_Security, I have enabled the mod_security rules
within HAProxy and I have Wordpress sites behind my load balancer. I am
confused on why I have quite a few false positives still being activated.

In my crs-setup.conf:

SecAction \
 "id:900130,\
  phase:1,\
  nolog,\
  pass,\
  t:none,\
  setvar:tx.crs_exclusions_wordpress=1”

I see that in the REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf, I have
quite a few rules in there that look like appropriate Wordpress exclusions,
however when I have users trying to edit/post messages to Wordpress rules
are still being fired. From what I can see in the logs, it appears Rule
941100 is constantly being triggered. Is there a rule that I am missing in
the exclusions that isn’t there by default?

Jul 21 08:10:04 localhost hapee-lb[3473802]: fe_mydomain.com/owasp_crs
ModSecurity: Warning. detected XSS using libinjection. [file
"/etc/hapee-2.2/modsec.rules.d/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"]
[line "37"] [id "941100"] [rev ""] [msg "XSS Attack Detected via
libinjection"] [data "Matched Data: XSS data found within ARGS:content:
<span style="font-weight: 400;">Let's be totally honest here for a minute!
At this moment in the digital evolution, your credit union website should d
(4130 characters omitted)"] [severity "2"] [ver "OWASP_CRS/3.3.2"]
[maturity "0"] [accuracy "0"] [tag "application-multi"] [tag
"language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag
"paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname
"10.241.155.221"] [uri "https://www.mydomain.com/wp-admin/admin-ajax.php"]
[unique_id "162688020249.349253"] [ref
"v2688,4353t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]

Jul 21 08:10:04 localhost hapee-lb[3473802]: fe_mydomain.com/owasp_crs
ModSecurity: Warning. Matched "Operator `Rx' with parameter
`(?i:(?:<\w[\s\S]*[\s\/]|['\"](?:[\s\S]*[\s\/])?)(?:on(?:d(?:e(?:vice(?:(?:orienta|mo)tion|proximity|found|light)|livery(?:success|error)|activate)|r(?:ag(?:e(?:n(?:ter|d)|xit)|(?:gestur|leav)e|start|d
(3146 characters omitted)' against variable `ARGS:content' (Value: `<span
style="font-weight: 400;">Let\xe2\x80\x99s be totally honest here for a
minute! At this moment (4613 characters omitted)' ) [file
"/etc/hapee-2.2/modsec.rules.d/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"]
[line "180"] [id "941160"] [rev ""] [msg "NoScript XSS InjectionChecker:
HTML Injection"] [data "Matched Data: <span style="font-weight: 400;">Let's
be totally honest here for a minute! At this moment in the digital
evolution, your credit union website should do a lot more for you than just
looki (4666 characters omitted)"] [severity "2"] [ver "OWASP_CRS/3.3.2"]
[maturity "0"] [accuracy "0"] [tag "application-multi"] [tag
"language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag
"paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname
"10.241.155.221"] [uri "https://www.mydomain.com/wp-admin/admin-ajax.php"]
[unique_id "162688020249.349253"] [ref
"o0,544v2688,4353t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]

Jul 21 08:10:04 localhost hapee-lb[3473802]: fe_mydomain.com/owasp_crs
[client 66.235.234.117] ModSecurity: Access denied with code 403 (phase 2).
Matched "Operator `Ge' with parameter `5' against variable
`TX:ANOMALY_SCORE' (Value: `10' ) [file
"/etc/hapee-2.2/modsec.rules.d/rules/REQUEST-949-BLOCKING-EVALUATION.conf"]
[line "80"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded
(Total Score: 10)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.3.2"]
[maturity "0"] [accuracy "0"] [tag "application-multi"] [tag
"language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname
"10.241.155.221"] [uri "https://www.mydomain.com/wp-admin/admin-ajax.php"]
[unique_id "162688020249.349253"] [ref ""]

Jul 21 08:10:04 localhost hapee-lb[3473802]: 66.235.234.117:38827
[21/Jul/2021:08:10:04.023] fe_mydomain.com~ be_mydomain.com/www 1/-1/0/-1/1
403 197 - - PH-- - 330/2/0/0/0 0/0 TLSv1.3 {|Basic QiRpdGU6QjFkM3IxNw==|
https://www.mydomain.com/wp-admin/post.php?post=7774&act|Mozilla/5.0
(Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/91.0.4472.114 Safari/537.36} "POST
https://www.mydomain.com/wp-admin/admin-ajax.php HTTP/2.0"

Jul 21 08:10:04 localhost hapee-lb[3473802]: fe_mydomain.com/owasp_crs
ModSecurity: Warning. detected XSS using libinjection. [file
"/etc/hapee-2.2/modsec.rules.d/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"]
[line "37"] [id "941100"] [rev ""] [msg "XSS Attack Detected via
libinjection"] [data "Matched Data: XSS data found within ARGS:content:
<span style="font-weight: 400;">Let's be totally honest here for a minute!
At this moment in the digital evolution, your credit union website should d
(4130 characters omitted)"] [severity "2"] [ver "OWASP_CRS/3.3.2"]
[maturity "0"] [accuracy "0"] [tag "application-multi"] [tag
"language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag
"paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname
"10.241.155.221"] [uri "https://www.mydomain.com/wp-admin/post.php"]
[unique_id "162688020416.416944"] [ref
"v2787,4353t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
Jul 21 08:10:04 localhost hapee-lb[3473802]: fe_mydomain.com/owasp_crs
ModSecurity: Warning. Matched "Operator `Rx' with parameter
`(?i:(?:<\w[\s\S]*[\s\/]|['\"](?:[\s\S]*[\s\/])?)(?:on(?:d(?:e(?:vice(?:(?:orienta|mo)tion|proximity|found|light)|livery(?:success|error)|activate)|r(?:ag(?:e(?:n(?:ter|d)|xit)|(?:gestur|leav)e|start|d
(3146 characters omitted)' against variable `ARGS:content' (Value: `<span
style="font-weight: 400;">Let\xe2\x80\x99s be totally honest here for a
minute! At this moment (4613 characters omitted)' ) [file
"/etc/hapee-2.2/modsec.rules.d/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"]
[line "180"] [id "941160"] [rev ""] [msg "NoScript XSS InjectionChecker:
HTML Injection"] [data "Matched Data: <span style="font-weight: 400;">Let's
be totally honest here for a minute! At this moment in the digital
evolution, your credit union website should do a lot more for you than just
looki (4666 characters omitted)"] [severity "2"] [ver "OWASP_CRS/3.3.2"]
[maturity "0"] [accuracy "0"] [tag "application-multi"] [tag
"language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag
"paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname
"10.241.155.221"] [uri "https://www.mydomain.com/wp-admin/post.php"]
[unique_id "162688020416.416944"] [ref
"o0,544v2787,4353t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]

Jul 21 08:10:04 localhost hapee-lb[3473802]: fe_mydomain.com/owasp_crs
[client 66.235.234.117] ModSecurity: Access denied with code 403 (phase 2).
Matched "Operator `Ge' with parameter `5' against variable
`TX:ANOMALY_SCORE' (Value: `10' ) [file
"/etc/hapee-2.2/modsec.rules.d/rules/REQUEST-949-BLOCKING-EVALUATION.conf"]
[line "80"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded
(Total Score: 10)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.3.2"]
[maturity "0"] [accuracy "0"] [tag "application-multi"] [tag
"language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname
"10.241.155.221"] [uri "https://www.mydomain.com/wp-admin/post.php"]
[unique_id "162688020416.416944"] [ref ""]

Jul 21 08:10:04 localhost hapee-lb[3473802]: 66.235.234.117:38827
[21/Jul/2021:08:10:04.285] fe_mydomain.com~ be_mydomain.com/www 1/-1/0/-1/1
403 197 - - PH-- - 333/2/0/0/0 0/0 TLSv1.3 {|Basic QiRpdGU6QjFkM3IxNw==|
https://www.mydomain.com/wp-admin/post.php?post=7774&act|Mozilla/5.0
(Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/91.0.4472.114 Safari/537.36} "POST
https://www.mydomain.com/wp-admin/post.php HTTP/2.0”


Appreciate your help and assistance on this..

Devin Acosta

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/