Re: Upgrade to owasp-coreruleset 4.13.0
Monah Baki <[email protected]> Sat, 5 Apr 2025 21:24:10 -0400
| Newsgroups | gmane.comp.apache.mod-security.user |
|---|---|
| Message-ID | <CALP3=x_4QLkWF3qWBsCK8VoiT644t2UuMQBHLybqyWvdy8-kQQ@mail.gmail.com> |
--===============0401645715682803027==
Content-Type: multipart/alternative; boundary="0000000000003e6c2006321215aa"
--0000000000003e6c2006321215aa
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Ofcourse
SecAction \
"id:900990,\
phase:1,\
pass,\
t:none,\
nolog,\
tag:'OWASP_CRS',\
ver:'OWASP_CRS/4.13.0',\
setvar:tx.crs_setup_version=3D4130"
Thanks
On Sat, Apr 5, 2025 at 7:19=E2=80=AFPM Christian Folini <christian.folini@n=
etnea.com>
wrote:
> Hey Monah,
>
> This is very strange. Filename, location and permissions look ok.
>
> Can you show us rule 900990 from crs-setup.conf, where tx.crs_setup_versi=
on
> is being set?
>
> Best,
>
> Christian
> On Sat, Apr 05, 2025 at 04:39:30PM -0400, Monah Baki wrote:
> > Hi Christian,
> >
> > ls -la /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf
> > -rw-r--r-- 1 mbaki mbaki 35639 Mar 31 11:18
> > /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf
> >
> >
> > Also
> >
> > mbaki@waf:~ $ ls -la /usr/local/etc/modsecurity/owasp-modsecurity-crs/
> > total 320
> > drwxr-xr-x 9 mbaki mbaki 1024 Apr 5 10:47 .
> > drwxr-xr-x 4 root wheel 512 Apr 5 10:57 ..
> > -rw-r--r-- 1 mbaki mbaki 518 Mar 31 11:18 .editorconfig
> > drwxr-xr-x 5 mbaki mbaki 512 Mar 31 11:18 .github
> > -rw-r--r-- 1 mbaki mbaki 661 Mar 31 11:18 .gitignore
> > -rw-r--r-- 1 mbaki mbaki 0 Mar 31 11:18 .gitmodules
> > -rw-r--r-- 1 mbaki mbaki 315 Mar 31 11:18 .linelint.yml
> > -rw-r--r-- 1 mbaki mbaki 432 Mar 31 11:18 .pre-commit-config.yaml
> > -rw-r--r-- 1 mbaki mbaki 751 Mar 31 11:18 .yamllint.yml
> > -rw-r--r-- 1 mbaki mbaki 144155 Mar 31 11:18 CHANGES.md
> > -rw-r--r-- 1 mbaki mbaki 28523 Mar 31 11:18 CONTRIBUTING.md
> > -rw-r--r-- 1 mbaki mbaki 6564 Mar 31 11:18 CONTRIBUTORS.md
> > -rw-r--r-- 1 mbaki mbaki 11489 Mar 31 11:18 INSTALL.md
> > -rw-r--r-- 1 mbaki mbaki 2783 Mar 31 11:18 KNOWN_BUGS.md
> > -rw-r--r-- 1 mbaki mbaki 11347 Mar 31 11:18 LICENSE
> > -rw-r--r-- 1 mbaki mbaki 2871 Mar 31 11:18 README.md
> > -rw-r--r-- 1 mbaki mbaki 4543 Mar 31 11:18 SECURITY.md
> > -rw-r--r-- 1 mbaki mbaki 89 Mar 31 11:18 SPONSORS.md
> > -rw-r--r-- 1 mbaki mbaki 35639 Mar 31 11:18 crs-setup.conf
> > drwxr-xr-x 2 mbaki mbaki 512 Mar 31 11:18 docs
> > drwxr-xr-x 2 mbaki mbaki 512 Mar 31 11:18 plugins
> > drwxr-xr-x 4 mbaki mbaki 2560 Mar 31 11:18 regex-assembly
> > -rw-r--r-- 1 mbaki mbaki 222 Mar 31 11:18 renovate.json
> > drwxr-xr-x 2 mbaki mbaki 2048 Apr 5 09:55 rules
> > drwxr-xr-x 5 mbaki mbaki 512 Mar 31 11:18 tests
> > drwxr-xr-x 5 mbaki mbaki 512 Mar 31 11:18 util
> >
> >
> > Thanks
> > Monah
> >
> > On Sat, Apr 5, 2025 at 4:26=E2=80=AFPM Christian Folini <
> [email protected]>
> > wrote:
> >
> > > Hey Monah,
> > >
> > > Are you sure the file
> > >
> > > /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf
> > >
> > > exists?
> > >
> > > The error message clearly says it can't be read:
> > >
> > > CRS is deployed without configuration!
> > > Please copy the crs-setup.conf.example template to crs-setup.conf, an=
d
> > > include the crs-setup.conf file in your webserver configuration befor=
e
> > > including the CRS rules. See the INSTALL file in the CRS directory fo=
r
> > > detailed instructions
> > >
> > > Best,
> > >
> > > Christian
> > >
> > > On Sat, Apr 05, 2025 at 04:02:09PM -0400, Monah Baki wrote:
> > > > Hello all,
> > > >
> > > > I am running Freebsd 14.2 and I upgraded my owasp to v4.13.0.
> However I
> > > am
> > > > seeing in my http error logs the following
> > > >
> > > > [Sat Apr 05 11:24:27.646852 2025] [security2:error] [pid 96152]
> [client
> > > > 23.95.132.51:56151] ModSecurity: Access denied with code 500 (phase
> 1).
> > > > Operator EQ matched 0 at TX. [file
> > > >
> > >
> "/usr/local/etc/modsecurity/owasp-modsecurity-crs/rules/REQUEST-901-INITI=
ALIZATION.conf"]
> > > > [line "64"] [id "901001"] [msg "CRS is deployed without
> configuration!
> > > > Please copy the crs-setup.conf.example template to crs-setup.conf,
> and
> > > > include the crs-setup.conf file in your webserver configuration
> before
> > > > including the CRS rules. See the INSTALL file in the CRS directory
> for
> > > > detailed instructions"] [severity "CRITICAL"] [ver
> "OWASP_CRS/4.13.0"]
> > > [tag
> > > > "OWASP_CRS"]
> > > >
> > > >
> > > > ls /usr/local/etc/modsecurity/owasp-modsecurity-crs
> > > > crs-setup.conf
> > > >
> > > > cat /usr/local/etc/apache24/modules.d/280_mod_security.conf
> > > > IncludeOptional
> > > > /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf
> > > > IncludeOptional
> > > >
> /usr/local/etc/modsecurity/owasp-modsecurity-crs/plugins/*-config.conf
> > > > IncludeOptional
> > > >
> /usr/local/etc/modsecurity/owasp-modsecurity-crs/plugins/*-before.conf
> > > > Include /usr/local/etc/modsecurity/owasp-modsecurity-crs/rules/*.co=
nf
> > > > IncludeOptional
> > > > /usr/local/etc/modsecurity/owasp-modsecurity-crs/plugins/*-after.co=
nf
> > > >
> > > >
> > > > Thanks
> > > > Monah
> > >
> > >
> > > > _______________________________________________
> > > > mod-security-users mailing list
> > > > [email protected]
> > > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLab=
s:
> > > > http://www.modsecurity.org/projects/commercial/rules/
> > > > http://www.modsecurity.org/projects/commercial/support/
> > >
> > >
> > >
> > > _______________________________________________
> > > mod-security-users mailing list
> > > [email protected]
> > > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > > http://www.modsecurity.org/projects/commercial/rules/
> > > http://www.modsecurity.org/projects/commercial/support/
> > >
>
>
> > _______________________________________________
> > mod-security-users mailing list
> > [email protected]
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>
--0000000000003e6c2006321215aa
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div>Ofcourse</div><div><br></div><div>SecAction \</div>=
=C2=A0 =C2=A0 "id:900990,\<br>=C2=A0 =C2=A0 phase:1,\<br>=C2=A0 =C2=A0=
pass,\<br>=C2=A0 =C2=A0 t:none,\<br>=C2=A0 =C2=A0 nolog,\<br>=C2=A0 =C2=A0=
tag:'OWASP_CRS',\<br>=C2=A0 =C2=A0 ver:'OWASP_CRS/4.13.0',=
\<br><div>=C2=A0 =C2=A0 setvar:tx.crs_setup_version=3D4130"</div><div>=
<br></div><div>Thanks</div></div><br><div class=3D"gmail_quote gmail_quote_=
container"><div dir=3D"ltr" class=3D"gmail_attr">On Sat, Apr 5, 2025 at 7:1=
9=E2=80=AFPM Christian Folini <<a href=3D"mailto:christian.folini@netnea=
.com">[email protected]</a>> wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex">Hey Monah,<br>
<br>
This is very strange. Filename, location and permissions look ok.<br>
<br>
Can you show us rule 900990 from crs-setup.conf, where tx.crs_setup_version=
<br>
is being set?<br>
<br>
Best,<br>
<br>
Christian<br>
On Sat, Apr 05, 2025 at 04:39:30PM -0400, Monah Baki wrote:<br>
> Hi Christian,<br>
> <br>
> ls -la=C2=A0 /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setu=
p.conf<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki 35639 Mar 31 11:18<br>
> /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf<br>
> <br>
> <br>
> Also<br>
> <br>
> mbaki@waf:~ $ ls -la=C2=A0 /usr/local/etc/modsecurity/owasp-modsecurit=
y-crs/<br>
> total 320<br>
> drwxr-xr-x=C2=A0 9 mbaki mbaki=C2=A0 =C2=A01024 Apr=C2=A0 5 10:47 .<br=
>
> drwxr-xr-x=C2=A0 4 root=C2=A0 wheel=C2=A0 =C2=A0 512 Apr=C2=A0 5 10:57=
..<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A0 518 Mar 31 11:18 .editorco=
nfig<br>
> drwxr-xr-x=C2=A0 5 mbaki mbaki=C2=A0 =C2=A0 512 Mar 31 11:18 .github<b=
r>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A0 661 Mar 31 11:18 .gitignor=
e<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A0 =C2=A0 0 Mar 31 11:18 .git=
modules<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A0 315 Mar 31 11:18 .linelint=
.yml<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A0 432 Mar 31 11:18 .pre-comm=
it-config.yaml<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A0 751 Mar 31 11:18 .yamllint=
.yml<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki 144155 Mar 31 11:18 CHANGES.md<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 28523 Mar 31 11:18 CONTRIBUTING.m=
d<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A06564 Mar 31 11:18 CONTRIBUT=
ORS.md<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 11489 Mar 31 11:18 INSTALL.md<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A02783 Mar 31 11:18 KNOWN_BUG=
S.md<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 11347 Mar 31 11:18 LICENSE<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A02871 Mar 31 11:18 README.md=
<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A04543 Mar 31 11:18 SECURITY.=
md<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A0 =C2=A089 Mar 31 11:18 SPON=
SORS.md<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 35639 Mar 31 11:18 crs-setup.conf=
<br>
> drwxr-xr-x=C2=A0 2 mbaki mbaki=C2=A0 =C2=A0 512 Mar 31 11:18 docs<br>
> drwxr-xr-x=C2=A0 2 mbaki mbaki=C2=A0 =C2=A0 512 Mar 31 11:18 plugins<b=
r>
> drwxr-xr-x=C2=A0 4 mbaki mbaki=C2=A0 =C2=A02560 Mar 31 11:18 regex-ass=
embly<br>
> -rw-r--r--=C2=A0 1 mbaki mbaki=C2=A0 =C2=A0 222 Mar 31 11:18 renovate.=
json<br>
> drwxr-xr-x=C2=A0 2 mbaki mbaki=C2=A0 =C2=A02048 Apr=C2=A0 5 09:55 rule=
s<br>
> drwxr-xr-x=C2=A0 5 mbaki mbaki=C2=A0 =C2=A0 512 Mar 31 11:18 tests<br>
> drwxr-xr-x=C2=A0 5 mbaki mbaki=C2=A0 =C2=A0 512 Mar 31 11:18 util<br>
> <br>
> <br>
> Thanks<br>
> Monah<br>
> <br>
> On Sat, Apr 5, 2025 at 4:26=E2=80=AFPM Christian Folini <<a href=3D=
"mailto:[email protected]" target=3D"_blank">christian.folini@net=
nea.com</a>><br>
> wrote:<br>
> <br>
> > Hey Monah,<br>
> ><br>
> > Are you sure the file<br>
> ><br>
> > /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.conf<b=
r>
> ><br>
> > exists?<br>
> ><br>
> > The error message clearly says it can't be read:<br>
> ><br>
> > CRS is deployed without configuration!<br>
> > Please copy the crs-setup.conf.example template to crs-setup.conf=
, and<br>
> > include the crs-setup.conf file in your webserver configuration b=
efore<br>
> > including the CRS rules. See the INSTALL file in the CRS director=
y for<br>
> > detailed instructions<br>
> ><br>
> > Best,<br>
> ><br>
> > Christian<br>
> ><br>
> > On Sat, Apr 05, 2025 at 04:02:09PM -0400, Monah Baki wrote:<br>
> > > Hello all,<br>
> > ><br>
> > > I am running Freebsd 14.2 and=C2=A0 I upgraded my owasp to v=
4.13.0. However I<br>
> > am<br>
> > > seeing in my http error logs the following<br>
> > ><br>
> > > [Sat Apr 05 11:24:27.646852 2025] [security2:error] [pid 961=
52] [client<br>
> > > <a href=3D"http://23.95.132.51:56151" rel=3D"noreferrer" tar=
get=3D"_blank">23.95.132.51:56151</a>] ModSecurity: Access denied with code=
500 (phase 1).<br>
> > > Operator EQ matched 0 at TX. [file<br>
> > ><br>
> > "/usr/local/etc/modsecurity/owasp-modsecurity-crs/rules/REQU=
EST-901-INITIALIZATION.conf"]<br>
> > > [line "64"] [id "901001"] [msg "CRS=
is deployed without configuration!<br>
> > > Please copy the crs-setup.conf.example template to crs-setup=
.conf, and<br>
> > > include the crs-setup.conf file in your webserver configurat=
ion before<br>
> > > including the CRS rules. See the INSTALL file in the CRS dir=
ectory for<br>
> > > detailed instructions"] [severity "CRITICAL"]=
[ver "OWASP_CRS/4.13.0"]<br>
> > [tag<br>
> > > "OWASP_CRS"]<br>
> > ><br>
> > ><br>
> > > ls /usr/local/etc/modsecurity/owasp-modsecurity-crs<br>
> > > crs-setup.conf<br>
> > ><br>
> > > cat /usr/local/etc/apache24/modules.d/280_mod_security.conf<=
br>
> > > IncludeOptional<br>
> > > /usr/local/etc/modsecurity/owasp-modsecurity-crs/crs-setup.c=
onf<br>
> > > IncludeOptional<br>
> > > /usr/local/etc/modsecurity/owasp-modsecurity-crs/plugins/*-c=
onfig.conf<br>
> > > IncludeOptional<br>
> > > /usr/local/etc/modsecurity/owasp-modsecurity-crs/plugins/*-b=
efore.conf<br>
> > > Include /usr/local/etc/modsecurity/owasp-modsecurity-crs/rul=
es/*.conf<br>
> > > IncludeOptional<br>
> > > /usr/local/etc/modsecurity/owasp-modsecurity-crs/plugins/*-a=
fter.conf<br>
> > ><br>
> > ><br>
> > > Thanks<br>
> > > Monah<br>
> ><br>
> ><br>
> > > _______________________________________________<br>
> > > mod-security-users mailing list<br>
> > > <a href=3D"mailto:[email protected]" =
target=3D"_blank">[email protected]</a><br>
> > > <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-=
security-users" rel=3D"noreferrer" target=3D"_blank">https://lists.sourcefo=
rge.net/lists/listinfo/mod-security-users</a><br>
> > > Commercial ModSecurity Rules and Support from Trustwave'=
s SpiderLabs:<br>
> > > <a href=3D"http://www.modsecurity.org/projects/commercial/ru=
les/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/proje=
cts/commercial/rules/</a><br>
> > > <a href=3D"http://www.modsecurity.org/projects/commercial/su=
pport/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/pro=
jects/commercial/support/</a><br>
> ><br>
> ><br>
> ><br>
> > _______________________________________________<br>
> > mod-security-users mailing list<br>
> > <a href=3D"mailto:[email protected]" targe=
t=3D"_blank">[email protected]</a><br>
> > <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-secur=
ity-users" rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.n=
et/lists/listinfo/mod-security-users</a><br>
> > Commercial ModSecurity Rules and Support from Trustwave's Spi=
derLabs:<br>
> > <a href=3D"http://www.modsecurity.org/projects/commercial/rules/"=
rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/c=
ommercial/rules/</a><br>
> > <a href=3D"http://www.modsecurity.org/projects/commercial/support=
/" rel=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects=
/commercial/support/</a><br>
> ><br>
<br>
<br>
> _______________________________________________<br>
> mod-security-users mailing list<br>
> <a href=3D"mailto:[email protected]" target=3D"=
_blank">[email protected]</a><br>
> <a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-security-u=
sers" rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/li=
sts/listinfo/mod-security-users</a><br>
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLa=
bs:<br>
> <a href=3D"http://www.modsecurity.org/projects/commercial/rules/" rel=
=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/comme=
rcial/rules/</a><br>
> <a href=3D"http://www.modsecurity.org/projects/commercial/support/" re=
l=3D"noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/comm=
ercial/support/</a><br>
<br>
<br>
<br>
_______________________________________________<br>
mod-security-users mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blan=
k">[email protected]</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/mod-security-users"=
rel=3D"noreferrer" target=3D"_blank">https://lists.sourceforge.net/lists/l=
istinfo/mod-security-users</a><br>
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:<b=
r>
<a href=3D"http://www.modsecurity.org/projects/commercial/rules/" rel=3D"no=
referrer" target=3D"_blank">http://www.modsecurity.org/projects/commercial/=
rules/</a><br>
<a href=3D"http://www.modsecurity.org/projects/commercial/support/" rel=3D"=
noreferrer" target=3D"_blank">http://www.modsecurity.org/projects/commercia=
l/support/</a><br>
</blockquote></div>
--0000000000003e6c2006321215aa--
--===============0401645715682803027==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--===============0401645715682803027==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/
--===============0401645715682803027==--