Apache mod-security

Eero Volotinen | 3 Jun 2012 13:00

modsecurity issues with large post-request?

Hi List,

Currently having issues with large POST requests. Is there way to
disable modsecurity, if POST request size is over 1MB ?

br,
--
Eero

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Josh Amishav-Zlatin | 3 Jun 2012 13:17

Re: modsecurity issues with large post-request?

On Sun, Jun 3, 2012 at 2:00 PM, Eero Volotinen <eero.volotinen <at> iki.fi> wrote:

Hi List,

Currently having issues with large POST requests. Is there way to
disable modsecurity, if POST request size is over 1MB ?

Hi Eero,

There are a number of ways you could disable ModSecurity for large POST requests, but then you may unnecessarily expose your application to attack. Are your large POST requests larger then your defined SecRequestBodyLimit or SecRequestBodyNoFilesLimit limit?

--

- Josh

br,
--
Eero

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Eero Volotinen | 3 Jun 2012 13:47

Re: modsecurity issues with large post-request?

2012/6/3 Josh Amishav-Zlatin <jamuse <at> gmail.com>:
> On Sun, Jun 3, 2012 at 2:00 PM, Eero Volotinen <eero.volotinen <at> iki.fi>
> wrote:
>>
>> Hi List,
>>
>> Currently having issues with large POST requests. Is there way to
>> disable modsecurity, if POST request size is over 1MB ?
>>
>
> Hi Eero,
>
> There are a number of ways you could disable ModSecurity for large POST
> requests, but then you may unnecessarily expose your application to attack.
> Are your large POST requests larger then your defined  SecRequestBodyLimit
> or SecRequestBodyNoFilesLimit limit?

Yes, POST request is larger than value and another issue is that my
POST data can be up to 30-50MB so,
so it's a bit slow to process in mod_security.

Can you still give instructions how to disable mod_security for POST
request larger than 1MB?

--
Eero

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Eero Volotinen | 3 Jun 2012 14:34

Re: modsecurity issues with large post-request?

2012/6/3 Josh Amishav-Zlatin <jamuse <at> gmail.com>:
> On Sun, Jun 3, 2012 at 2:47 PM, Eero Volotinen <eero.volotinen <at> iki.fi>
> wrote:
>>
>>
>> Can you still give instructions how to disable mod_security for POST
>> request larger than 1MB?
>>
>
> Do you want to whitelist a specific IP/range who can send large POST
> requests (ideal) or completely bypass large POST requests?

I just want to disable completely large POST request processing.

--
Eero

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Josh Amishav-Zlatin | 3 Jun 2012 15:01

Re: modsecurity issues with large post-request?

On Sun, Jun 3, 2012 at 2:47 PM, Eero Volotinen <eero.volotinen <at> iki.fi> wrote:

2012/6/3 Josh Amishav-Zlatin <jamuse <at> gmail.com>:
> On Sun, Jun 3, 2012 at 2:00 PM, Eero Volotinen <eero.volotinen <at> iki.fi>
> wrote:
>>
>> Hi List,
>>
>> Currently having issues with large POST requests. Is there way to
>> disable modsecurity, if POST request size is over 1MB ?
>>
>
> Hi Eero,
>
> There are a number of ways you could disable ModSecurity for large POST
> requests, but then you may unnecessarily expose your application to attack.
> Are your large POST requests larger then your defined SecRequestBodyLimit
> or SecRequestBodyNoFilesLimit limit?

Yes, POST request is larger than value and another issue is that my
POST data can be up to 30-50MB so,
so it's a bit slow to process in mod_security.

Can you still give instructions how to disable mod_security for POST
request larger than 1MB?

Hi Eero,

If the limit your hitting is from the CRS, then I suggest whitelisting the rule causing the issue (e.g. 960342). If the limit your hitting is due to your SecRequestBodyLimit setting and you are completely aware of the consequences of whitelisting all POST requests with a content-length field over 1MB, and raising the request body limit is not an option, you could use a rule like the following to disable the rules engine for those requests (ideally you would limit this to a specific URI / IP as well):

SecRule REQUEST_HEADERS:Content-Length " <at> gt 131072" "phase:1,id:1,pass,chain, \

log,msg:'Completely disabled ModSecurity for this request',ctl:ruleEngine=Off"

SecRule REQUEST_METHOD POST

--

- Josh

--
Eero

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Eero Volotinen | 3 Jun 2012 15:12

Re: modsecurity issues with large post-request?

> If the limit your hitting is from the CRS, then I suggest whitelisting the
> rule causing the issue (e.g. 960342). If the limit your hitting is due to
> your SecRequestBodyLimit setting and you are completely aware of the
> consequences of whitelisting all POST requests with a content-length field
> over 1MB, and raising the request body limit is not an option, you could use
> a rule like the following to disable the rules engine for those requests
> (ideally you would limit this to a specific URI / IP as well):
>
> SecRule REQUEST_HEADERS:Content-Length " <at> gt 131072"
> "phase:1,id:1,pass,chain, \
>   log,msg:'Completely disabled ModSecurity for this
> request',ctl:ruleEngine=Off"
>     SecRule REQUEST_METHOD POST

Thanks.

--
Eero

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Ryan Barnett | 4 Jun 2012 17:25

Seeking Full-time ModSecurity Dev/Researcher

Our team is growing! We are expanding our SpiderLabs Research team and are looking to add another full-time security researcher/developer to help with the ModSecurity project. Details here: http://hire.jobvite.com/Jobvite/Job.aspx?m=npHzNiwf&j=oKNrWfwE

--
Ryan Barnett
Researcher Lead
Trustwave - SpiderLabs
ModSecurity Project Leader

This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Ryan Barnett | 6 Jun 2012 15:03

Dynamic DAST/WAF Integration

I released a blog post yesterday outlining the "Dynamic DAST/WAF Integration" concept that shows how to integrate ModSecurity with the Arachni scanner (http://arachni-scanner.com/) using the Lua API to achieve realtime virtual patching.

http://blog.spiderlabs.com/2012/06/dynamic-dastwaf-integration-realtime-virtual-patching.html

There are links in the blog post that point to the new files in the SF SVN trunk repo if you want give this a try.

Cheers.

--

Ryan Barnett
Trustwave SpiderLabs

ModSecurity Project Leader
OWASP ModSecurity CRS Project Leader

This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/

_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Usman Waheed | 7 Jun 2012 10:20

Mod Security XML Parsing

Hi,

The mod security handbook states that XML parsing is expensive (cpu and  
ram) but i was wondering if out of the three (validateSchema, validateDTD  
and XPATH checks) which one is least intensive or maybe it does not matter  
because we run the XML parser in all three cases?

In my test application, the client will always POST XML in the request  
body and i would like to validate and sanitize. At the moment i am using  
validateSchema and it works fine but
then maybe there is a more efficient way.

I was thinking maybe if i used XPATH expressions for checking the xml  
inputs instead of using validateDTD or validateSchema it might be less  
expensive?

Thanks,
Usman

--

-- 
Using Opera's revolutionary email client: http://www.opera.com/mail/

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

headers

Mandar Jog | 9 Jun 2012 04:44

413 Request Entity Too Large for chunked encoded message

I use mod security to log requset body amongst other things.
This affects my production systems to any help is much appreciated.

A particular type of request is a POST of xml data with chunked encoding.
mod_security is rejecting about 20% of these POSTs with a '413 Request
Entity Too Large'

       SecAuditEngine On
       SecRuleEngine On
       SecRequestBodyLimit 132217728
       SecRequestBodyNoFilesLimit 132217728
       SecRequestBodyInMemoryLimit 132217728

I have set these limits to be incredibly high.
even with these I continue to get the 413 errors. I can be asolutely
certain that the POST request is less that 132M like I have
configured.

--58fded3e-A--
[09/Jun/2012:00:33:20 +0000] T9KZvwr-fhAAAGPsEZUAAACL 10.248.5.170
36263 10.255.126.16 80
--58fded3e-B--
POST /Y2ZhNjliMTM1YzVkY2MzOTZjMzZmMzg5ZDA1Yzg0N2E= HTTP/1.1
host: abc.com
Cache-Control: no-cache
Content-type: text/xml
User-Agent: egauge/pusher
X-Forwarded-For: 65.220.109.5
X-Forwarded-Port: 80
X-Forwarded-Proto: http
transfer-encoding: chunked
Connection: keep-alive

--58fded3e-F--
HTTP/1.1 413 Request Entity Too Large

--58fded3e-Z--

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
mod-security-users mailing list
mod-security-users <at> lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/

79	May 2013
69	April 2013
107	March 2013
96	February 2013
96	January 2013
60	December 2012
42	November 2012
52	October 2012
62	September 2012
64	August 2012
95	July 2012
60	June 2012
39	May 2012
11	April 2012
46	March 2012
123	February 2012
80	January 2012
44	December 2011
51	November 2011
78	October 2011
108	September 2011
104	August 2011
111	July 2011
66	June 2011
185	May 2011
54	April 2011
72	March 2011
69	February 2011
76	January 2011
26	December 2010
51	November 2010
69	October 2010
79	September 2010
67	August 2010
67	July 2010
59	June 2010
88	May 2010
59	April 2010
130	March 2010
117	February 2010
99	January 2010
80	December 2009
156	November 2009
112	October 2009
73	September 2009
134	August 2009
92	July 2009
78	June 2009
132	May 2009
104	April 2009
127	March 2009
131	February 2009
137	January 2009
85	December 2008
82	November 2008
84	October 2008
154	September 2008
167	August 2008
187	July 2008
95	June 2008
115	May 2008
89	April 2008
97	March 2008
134	February 2008
159	January 2008
56	December 2007
205	November 2007
135	October 2007
97	September 2007
162	August 2007
130	July 2007
250	June 2007
191	May 2007
150	April 2007
181	March 2007
161	February 2007
166	January 2007
104	December 2006
172	November 2006
103	October 2006
83	September 2006
101	August 2006
92	July 2006
116	June 2006
65	May 2006
139	April 2006
82	March 2006
148	February 2006
61	January 2006
74	December 2005
104	November 2005
49	October 2005
28	September 2005
51	August 2005
27	July 2005
71	June 2005
26	May 2005
53	April 2005
82	March 2005
61	February 2005
67	January 2005
12	December 2004
22	November 2004
28	October 2004
31	September 2004
24	August 2004
36	July 2004
20	June 2004
15	May 2004
47	April 2004
21	March 2004
13	February 2004
44	January 2004
18	December 2003
13	November 2003
11	October 2003
9	September 2003
7	August 2003
16	July 2003
1	June 2003

Mon	Tue	Wed	Thu	Fri	Sat	Sun

				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30