#Modsecurity action software
#Modsecurity action code

It is used to stop attacks towards script-driven sites by employing security rules which contain certain expressions. For that reason, the above rule inspects REQUEST_URI_RAW, and avoids the use of transformations like t:urlDecode or t:urlDecodeUni.ModSecurity is a plugin for Apache web servers which acts as a web application layer firewall. SecRule REQUEST_URI_RAW #' 'id:1,phase:1,deny,status:403,msg:'URI Fragment in request line''ДЄ вЂ#вЂ™ may be valid in the request line if it is encoded. Since legitimate clients do not send URI fragments in HTTP Requests, simple mitigation is to inspect for the вЂ#вЂ™ in each undecoded request line. Reject requests containing a URI fragment

Fortunately, there is an alternative that should be effective in most deployments.

#Modsecurity action software

While upgrading to an updated version of the software is good advice, some users may find that impractical on short notice. Fortunately, these are less likely to have a large proportion of rules testing exact values for query arguments. Some generic rule sets are open source and hence available for inspection. Without sufficient knowledge вЂ“ either direct or deduced вЂ“ it would be difficult to successfully target a susceptible rule. Taking advantage of this bypass mechanism would typically require detailed knowledge of the rule against which evasion is being attempted. Rules that look for string prefixes, substrings, non-anchored regex, etc. Because inclusion of the URI fragment affects how a query argument value terminates (as perceived by ModSecurity), rules that test exact values (such as or string endings (such as a regular expression with the end-anchor '$') would be susceptible.

Most types of rules will not be impacted even if they are inspecting ARGS or ARGS_GET. In other words, rules that inspect ARGS or ARGS_GET are the main area of concern. Not all ModSecurity rules would be susceptible to bypass due to this problem.В Because URI fragments can appear only in the request line, query argument values are what are chiefly affected. This could be used to evade some ModSecurity rules, such as: But ModSecurity will take everything to the right of the вЂ=вЂ™ and record the value of that query argument as the seven-character string вЂdef#ghiвЂ™.

#Modsecurity action code

Server PHP code like $_GET will yield вЂdefвЂ™ as the value. However, if a malicious actor were to send a URI fragment using a tool that allows it (such as BurpSuite), it would be handled incorrectly by ModSecurity 3.0.0-3.0.4 in a possibly security-relevant way.ДЇor example, with a request like the following sent to nginx with ModSecurity v3: For example, a browser may use the fragment information to jump to some heading within a document. Browsers do not send the fragment information to the server and instead use it for client-side processing only. URI Fragments with ModSecurity v3ДЄn HTTP request line can include an optional URI fragment. The bug has been addressed with a fix in v3.0.5. The main consequence of the bug is that some ModSecurity rules could be evaded by a malicious actor. This blog post discusses an input interpretation bug in ModSecurity v3 related to URI fragments that was identified during a recent internal security review. ModSecurity is an open-source WAF engine maintained by Trustwave.