Skip to content

Commit fc905d9

Browse files
airweenairween
authored
Merge pull request #3464 from airween/v3/encodejsaudit
fix: encode possible binary characters from user input in audit logs
2 parents 032ccae + 102275f commit fc905d9

File tree

3 files changed

+191
-5
lines changed

3 files changed

+191
-5
lines changed

‎src/operators/operator.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,15 +112,15 @@ std::string Operator::resolveMatchMessage(Transaction *t,
112112
if (m_couldContainsMacro == false) {
113113
ret = "Matched \"Operator `" + m_op + "' with parameter `" +
114114
utils::string::limitTo(200, m_param) +
115-
"' against variable `" + key + "' (Value: `" +
115+
"' against variable `" + utils::string::toHexIfNeeded(key) + "' (Value: `" +
116116
utils::string::limitTo(100,
117117
utils::string::toHexIfNeeded(value)) + \
118118
"' )";
119119
} else {
120120
std::string p(m_string->evaluate(t));
121121
ret = "Matched \"Operator `" + m_op + "' with parameter `" +
122122
utils::string::limitTo(200, p) +
123-
"' against variable `" + key + "' (Value: `" +
123+
"' against variable `" + utils::string::toHexIfNeeded(key) + "' (Value: `" +
124124
utils::string::limitTo(100,
125125
utils::string::toHexIfNeeded(value)) +
126126
"' )";

‎src/transaction.cc‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1610,7 +1610,7 @@ std::string Transaction::toJSON(int parts) {
16101610

16111611
if (parts & audit_log::AuditLog::CAuditLogPart) {
16121612
// FIXME: check for the binary content size.
1613-
LOGFY_ADD("body", this->m_requestBody.str());
1613+
LOGFY_ADD("body", utils::string::toHexIfNeeded(this->m_requestBody.str()));
16141614
}
16151615

16161616
/* request headers */
@@ -1622,7 +1622,7 @@ std::string Transaction::toJSON(int parts) {
16221622

16231623
m_variableRequestHeaders.resolve(&l);
16241624
for (auto &h : l) {
1625-
LOGFY_ADD(h->getKey().c_str(), h->getValue());
1625+
LOGFY_ADD(utils::string::toHexIfNeeded(h->getKey().c_str()).c_str(), utils::string::toHexIfNeeded(h->getValue()));
16261626
delete h;
16271627
}
16281628

@@ -1712,7 +1712,7 @@ std::string Transaction::toJSON(int parts) {
17121712
LOGFY_ADD("ruleId", std::to_string(a.m_rule.m_ruleId));
17131713
LOGFY_ADD("file", a.m_rule.getFileName());
17141714
LOGFY_ADD("lineNumber", std::to_string(a.m_rule.getLineNumber()));
1715-
LOGFY_ADD("data", a.m_data);
1715+
LOGFY_ADD("data", utils::string::toHexIfNeeded(a.m_data));
17161716
LOGFY_ADD("severity", std::to_string(a.m_severity));
17171717
LOGFY_ADD("ver", a.m_rule.m_ver);
17181718
LOGFY_ADD("rev", a.m_rule.m_rev);

‎test/test-cases/regression/auditlog.json‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -536,5 +536,191 @@
536536
"SecAuditLogType Serial",
537537
"SecAuditLogRelevantStatus \"^(?:5|4(?!04))\""
538538
]
539+
},
540+
{
541+
"enabled": 1,
542+
"version_min": 300000,
543+
"version_max": 0,
544+
"title": "auditlog : Binary char from input, check message",
545+
"client": {
546+
"ip": "200.249.12.31",
547+
"port": 2313
548+
},
549+
"server": {
550+
"ip": "200.249.12.31",
551+
"port": 80
552+
},
553+
"request": {
554+
"headers": {
555+
"Host": "www.modsecurity.org",
556+
"User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)",
557+
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
558+
"Accept-Language": "en-us,en;q=0.5",
559+
"Accept-Encoding": "gzip,deflate",
560+
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
561+
"Keep-Alive": "300",
562+
"Connection": "keep-alive",
563+
"Pragma": "no-cache",
564+
"Cache-Control": "no-cache"
565+
},
566+
"uri": "\/?%ADd+allow%3d1+%ADd+auto",
567+
"method": "GET",
568+
"http_version": 1.1,
569+
"body": ""
570+
},
571+
"response": {
572+
"headers": {
573+
"Content-Type": "plain\/text\n\r"
574+
},
575+
"body": [
576+
"test"
577+
]
578+
},
579+
"expected": {
580+
"audit_log": "\"match\":\"Matched \\\\\"Operator `ValidateUtf8Encoding' with parameter `' against variable `ARGS_NAMES:\\\\\\\\xadd allow=1 \\\\\\\\xadd auto' \\(Value: `\\\\\\\\xadd allow=1 \\\\\\\\xadd auto' \\)\"",
581+
"debug_log": "",
582+
"error_log": "",
583+
"http_code": 403
584+
},
585+
"rules": [
586+
"SecRuleEngine On",
587+
"SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES \"@validateUtf8Encoding\" \"id:920250,phase:2,deny,t:none,msg:'UTF8 Encoding Abuse Attack Attempt',logdata:'%{MATCHED_VAR}'",
588+
"SecAuditEngine RelevantOnly",
589+
"SecAuditLogParts ABHJZ",
590+
"SecAuditLogFormat JSON",
591+
"SecAuditLogStorageDir /tmp/test",
592+
"SecAuditLog /tmp/audit_test_prefix.log",
593+
"SecAuditLogDirMode 0766",
594+
"SecAuditLogFileMode 0600",
595+
"SecAuditLogType Serial",
596+
"SecAuditLogRelevantStatus \"^(?:5|4(?!04))\""
597+
]
598+
},
599+
{
600+
"enabled": 1,
601+
"version_min": 300000,
602+
"version_max": 0,
603+
"title": "auditlog : Binary char from input, check body",
604+
"client": {
605+
"ip": "200.249.12.31",
606+
"port": 2313
607+
},
608+
"server": {
609+
"ip": "200.249.12.31",
610+
"port": 80
611+
},
612+
"request": {
613+
"headers": {
614+
"Host": "www.modsecurity.org",
615+
"User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)",
616+
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
617+
"Accept-Language": "en-us,en;q=0.5",
618+
"Accept-Encoding": "gzip,deflate",
619+
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
620+
"Keep-Alive": "300",
621+
"Connection": "keep-alive",
622+
"Pragma": "no-cache",
623+
"Cache-Control": "no-cache",
624+
"Content-Type": "application/x-www-form-urlencoded",
625+
"Content-Length": "3"
626+
},
627+
"uri": "\/?attack=true",
628+
"method": "POST",
629+
"http_version": 1.1,
630+
"body": [
631+
"\u00ad=\u00ad"
632+
]
633+
},
634+
"response": {
635+
"headers": {
636+
"Content-Type": "plain\/text\n\r"
637+
},
638+
"body": [
639+
"test"
640+
]
641+
},
642+
"expected": {
643+
"audit_log": "\"body\":\"\\\\\\\\xc2\\\\\\\\xad=\\\\\\\\xc2\\\\\\\\xad\\\\\\\\x0a",
644+
"debug_log": "",
645+
"error_log": "",
646+
"http_code": 403
647+
},
648+
"rules": [
649+
"SecRuleEngine On",
650+
"SecRule ARGS_NAMES \"@rx attack\" \"id:1,phase:2,deny,t:none",
651+
"SecAuditEngine RelevantOnly",
652+
"SecAuditLogParts ABCHJZ",
653+
"SecAuditLogFormat JSON",
654+
"SecAuditLogStorageDir /tmp/test",
655+
"SecAuditLog /tmp/audit_test_prefix.log",
656+
"SecAuditLogDirMode 0766",
657+
"SecAuditLogFileMode 0600",
658+
"SecAuditLogType Serial",
659+
"SecAuditLogRelevantStatus \"^(?:5|4(?!04))\""
660+
]
661+
},
662+
{
663+
"enabled": 1,
664+
"version_min": 300000,
665+
"version_max": 0,
666+
"title": "auditlog : Binary char from input, check header",
667+
"client": {
668+
"ip": "200.249.12.31",
669+
"port": 2313
670+
},
671+
"server": {
672+
"ip": "200.249.12.31",
673+
"port": 80
674+
},
675+
"request": {
676+
"headers": {
677+
"Host": "www.modsecurity.org",
678+
"User-Agent": "Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.1.5) Gecko\/20091102 Firefox\/3.5.5 (.NET CLR 3.5.30729)",
679+
"Accept": "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8",
680+
"Accept-Language": "en-us,en;q=0.5",
681+
"Accept-Encoding": "gzip,deflate",
682+
"Accept-Charset": "ISO-8859-1,utf-8;q=0.7,*;q=0.7",
683+
"Keep-Alive": "300",
684+
"Connection": "keep-alive",
685+
"Pragma": "no-cache",
686+
"Cache-Control": "no-cache",
687+
"Content-Type": "application/x-www-form-urlencoded",
688+
"Content-Length": "3",
689+
"X-\u00ad-custom": "Some \u00ad value"
690+
},
691+
"uri": "\/?attack=true",
692+
"method": "POST",
693+
"http_version": 1.1,
694+
"body": [
695+
"\u00ad=\u00ad"
696+
]
697+
},
698+
"response": {
699+
"headers": {
700+
"Content-Type": "plain\/text\n\r"
701+
},
702+
"body": [
703+
"test"
704+
]
705+
},
706+
"expected": {
707+
"audit_log": "\"X-\\\\\\\\xc2\\\\\\\\xad-custom\":\"Some \\\\\\\\xc2\\\\\\\\xad value\"",
708+
"debug_log": "",
709+
"error_log": "",
710+
"http_code": 403
711+
},
712+
"rules": [
713+
"SecRuleEngine On",
714+
"SecRule ARGS|ARGS_NAMES \"@rx attack\" \"id:1,phase:2,deny,t:none",
715+
"SecAuditEngine RelevantOnly",
716+
"SecAuditLogParts ABHJZ",
717+
"SecAuditLogFormat JSON",
718+
"SecAuditLogStorageDir /tmp/test",
719+
"SecAuditLog /tmp/audit_test_prefix.log",
720+
"SecAuditLogDirMode 0766",
721+
"SecAuditLogFileMode 0600",
722+
"SecAuditLogType Serial",
723+
"SecAuditLogRelevantStatus \"^(?:5|4(?!04))\""
724+
]
539725
}
540726
]

0 commit comments

Comments
 (0)