我刚刚为 Apache mod_security 安装了 CRS,它报告所有 PDF 文件都可能受到攻击。具体来说,正是modsecurity_crs_20_protocol_violations.conf
这些文件以 0 开头,才导致出现问题。
当用户尝试下载任何 PDF 文件时,我收到此日志(域名已更改):
[Tue Jul 08 15:02:40.695235 2014] [ratelimit:error] [pid 6875:tid 140072931452672]
[client 149.255.82.154:57722] AH01457: rl: brigade pass failed., referer:
http://example.com/downloads/
[Tue Jul 08 15:02:41.081811 2014] [:error] [pid 6875:tid 140072923059968] [client
149.255.82.154] ModSecurity: Warning. String match "bytes=0-" at
REQUEST_HEADERS:Range. [file "/etc/httpd/crs/activated_rules
/modsecurity_crs_20_protocol_violations.conf"] [line "428"] [id "958291"] [rev "2"]
[msg "Range: field exists and begins with 0."] [data "bytes=0-65535"] [severity
"WARNING"] [ver "OWASP_CRS/2.2.9"] [maturity "6"] [accuracy "8"] [tag
"OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [hostname "example.com"] [uri
"/app/files/broz_pd.pdf"] [unique_id "U7vr8X8AAAEAABrbRKQAAACB"]
我尝试通过创建modsecurity_15_whitelist.conf
并添加以下内容将 PDF 文件列入白名单:
SecRule ".*\.pdf$" "phase:1,id:158963,t:none,nolog,noauditlog,pass"
(并重新启动 Apache)但没有成功。
有人能帮助我摆脱这些误报吗?
答案1
在文件中添加此行/etc/modsecurity/modsecurity.conf
并重新启动 apache。
SecRule REQUEST_URI ".*\.(pdf|jpeg|png|xml)\?$" "phase:1,id:1001,nolog,t:urlDecode,t:lowercase,t:normalizePath,ctl:ruleRemoveById=958291"