diff --git a/apache2/modsecurity.h b/apache2/modsecurity.h
index e5cc63b4..c86145fd 100644
--- a/apache2/modsecurity.h
+++ b/apache2/modsecurity.h
@@ -48,7 +48,7 @@ typedef struct msc_string msc_string;
#include "http_protocol.h"
#define MODULE_NAME "ModSecurity"
-#define MODULE_RELEASE "2.1.2-rc3"
+#define MODULE_RELEASE "2.1.2"
#define MODULE_NAME_FULL (MODULE_NAME " v" MODULE_RELEASE " (Apache 2.x)")
#define PHASE_REQUEST_HEADERS 1
diff --git a/doc/modsecurity2-apache-reference.xml b/doc/modsecurity2-apache-reference.xml
index b2ad5ab9..72e3917c 100644
--- a/doc/modsecurity2-apache-reference.xml
+++ b/doc/modsecurity2-apache-reference.xml
@@ -3,7 +3,7 @@
ModSecurity Reference Manual
- Version 2.1.2-rc3 / (July 24, 2007)
+ Version 2.1.2 / (July 25, 2007)
2004-2007
diff --git a/rules/CHANGELOG b/rules/CHANGELOG
index e78a4fa9..0dd2ae23 100644
--- a/rules/CHANGELOG
+++ b/rules/CHANGELOG
@@ -1,19 +1,57 @@
+--------------------------------
+version 1.4.3 - 2007/07/21
+--------------------------------
+
+New Events:
+- 950012 - HTTP Request Smuggling
+ For more info on this attack:
+ http://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf
+- 960912 - Invalid request body
+ Malformed content will not be parsed by modsecurity, but still there might
+ be applications that will parse it, ignoring the errors.
+- 960913 - Invalid Request
+ Will trigger a security event when request was rejected by apache with
+ code 400, without going through ModSecurity rules.
+
+False Positives Fixes:
+- 950107 - Will allow a % sign in the middle of a string as well
+- 960911 - A more accurate expression based on the rfc:
+ http://www.ietf.org/rfc/rfc2396.txt
+- 950015 - Will not look for http/ pattern in the request headers
+
+Additional rules logic:
+- Since Apache applies scope directives only after ModSecurity phase 1
+ this directives cannot be used to exclude phase 1 rules. Therefore
+ we moved all inspection rules to phase 2.
+
--------------------------------
version 1.4 build 2 - 2007/05/17
--------------------------------
+
New Feature:
- Search for signatures in XML content
+ XML Content will be parsed and ispected for signatures
New Events:
-- 950107 - Unicode Full/Half Width Abuse Attack Attempt
+- 950116 - Unicode Full/Half Width Abuse Attack Attempt
+ Full-width unicode can by used to bypass content inspection. Such encoding will be forbidden
+ http://www.kb.cert.org/vuls/id/739224
- 960911 - Invalid HTTP request line
+ Enforce request line to be valid, i.e.:
- 960904 - Request Missing Content-Type (when there is content)
+ When a request contains content, the content-type must be specified. If not, the content will not be inspected
- 970018 - IIS installed in default location (any drive)
+ Log once if IIS in installed in the /Inetpub directory (on any drive, not only C)
- 950019 - Email Injection
+ Web forms used for sending mail (such as “tell a friend”) are often manipulated by spammers for sending anonymous emails
Regular expressions fixes:
- Further optimization of some regular expressions (using the non-greediness operator)
+ The non-greediness operator, , prevents excessive backtracking
+
+FP fixes:
+- Rule 950107 - Will allow a parameter to end in a % sign from now on
------------------------
version 1.4 - 2007/05/02
@@ -23,7 +61,7 @@ New Events:
- 970021 - WebLogic information disclosure
Matching of "JSP compile error" in the response body, will trigger this rule, with severity 4 (Warning)
- 950015,950910,950911 - HTTP Response Splitting
- Looking for HTTP Response Splitting patterns as described in Amit Klein's excellent article:
+ Looking for HTTP Response Splitting patterns as described in Amit Klein's excellent white paper:
http://www.packetstormsecurity.org/papers/general/whitepaper_httpresponse.pdf
ModSecurity does not support compressed content at the moment. Thus, the following rules have been added:
- 960902 - Content-Encoding in request not supported
@@ -60,11 +98,11 @@ Added persistent PDF UXSS detection rule
Version 1.3.2 build 3 2007/01/10
--------------------------------
-Fixed regular expression in rule 960010 (file #30) to allow multipart form data
+Fixed regular expression in rule 960010 (file #30) to allow multipart form data
content
--------------------------
-Version 1.3.2 - 2006/12/27
+Version 1.3.2 - 2006/12/27
--------------------------
New events:
@@ -93,7 +131,7 @@ Additional rules logic:
- Changed default action in file #50 to pass instead of deny.
- Moved IP host header from protocol violations to protocol anomalies.
-Modified descriptions:
+Modified descriptions:
- 950107: URL Encoding Abuse Attack Attempt
- 950801: UTF8 Encoding Abuse Attack Attempt
- Added matched pattern in many events using capture and %{TX.0}
@@ -106,11 +144,11 @@ Version 1.2 - 2006/11/19
Changes:
+ Move all events to the range of events allocated to Thinking Stone, now Breach
by prefixing all event IDs with "9".
-+ Reverse severities to follow the Syslog format used by ModSecurity, now 1 is
-the highest and 5 the lowest.
++ Reverse severities to follow the Syslog format used by ModSecurity, now 1 is
+the highest and 5 the lowest.
Bug fixes:
-+ Removed quotes from list of mime types inspected on exit (directive
++ Removed quotes from list of mime types inspected on exit (directive
SecResponseBodyMimeType)
+ Corrected "cd .." signature. Now the periods are escaped.
+ Too many FPs with events 950903 & 950905. Commented them out until fixed.
@@ -119,4 +157,4 @@ SecResponseBodyMimeType)
Version 1.1 - 2006/10/18
------------------------
-Initial version
+Initial version
diff --git a/rules/README b/rules/README
index 57d6bc59..57fd34fa 100644
--- a/rules/README
+++ b/rules/README
@@ -1,21 +1,22 @@
-
+==============================
ModSecurity Core Rule Set
==============================
-(c) 2006 Breach Secuiry Inc.
+(c) 2006-2007 Breach Secuiry Inc.
The ModSecurity Core Rule Set is provided to you under the terms and
conditions of GPL version 2
This directory contains the files for Core ModSecurity Rule Set
-The rules are compatible with ModSecurity 2.1 (as of version 1.3.2)
+The rules are compatible with ModSecurity 2.5 (as of version 1.4.3)
+
+
-
Overview
---------
+========
-Using ModSecurity requires rules. In order to enable users to take full
+Using ModSecurity requires rules. In order to enable users to take full
advantage of ModSecurity immediately, Breach Security Inc. is providing a free
Core rule set. Unlike intrusion detection and prevention systems which
rely on signature specific to known vulnerabilities, the Core Rule Set
@@ -31,12 +32,13 @@ training and professional services to assist you in doing that. The Core
Rule Set is heavily commented to allow it to be used as a step-by-step
deployment guide for ModSecurity.
-For more information refer to the Core Rule Set page at
+For more information refer to the Core Rule Set page at
http://www.modsecurity.org/
+
Core Rule Set Structure & Usage
-------------------------------------
+====================================
To activate the rules for your web server installation:
@@ -62,8 +64,38 @@ To activate the rules for your web server installation:
to ModSecurity Console in real time, check the alert was
correctly recorded there too.
+
+Known Issues
+===============
+
+Apache requests rejection and phase 2 rules
+-------------------------------------------
+
+Since now all inspection rules are executed in phase 2, several protocol
+validation is done by Apache prior to ModSecurity. This is by no means a
+security issue as Apache would block the requests, but the alert would appear
+in the ModSecurity audit log as a generic event "Invalid Request (960913)"
+
+Here's a list of the events that modsecurity might not log due to this issue:
+- Validate encoding - 950107
+ When invalid encoding is found in the URI
+- Validate utf-8 encoding - 950801
+ When invalid encoding is found in the URI
+- Method not allowed by policy - 960032
+ When the request uses a method that Apache doesn't know such as: CONNECT, SUBSCRIBE, etc.
+
+
+Google Analytics
+----------------
+
+For Google Analytics account activation, you will need to disable
+the Core Rules temporarily, then enable them after your Google account is
+activated. More info can be found in the mod-security-mailing-list:
+http://sourceforge.net/mailarchive/message.php?msg_name=1179692394.26994.10.camel%40localhost
+
+
About Regular Expressions
--------------------------
+============================
One of the advantages of the Core Rule Set, being a set of text files is your
ability to modify it. However you will find that the regular expressions used
@@ -79,7 +111,7 @@ of regular expressions.
Core Rule Set Content
---------------------------
+=========================
In order to provide generic web applications protection, the Core Rule Set
uses the following techniques:
diff --git a/rules/blocking/modsecurity_crs_20_protocol_violations.conf b/rules/blocking/modsecurity_crs_20_protocol_violations.conf
index 484085af..af8af60c 100644
--- a/rules/blocking/modsecurity_crs_20_protocol_violations.conf
+++ b/rules/blocking/modsecurity_crs_20_protocol_violations.conf
@@ -1,74 +1,94 @@
-# ---------------------------------------------------------------
-# Core ModSecurity Rule Set
-# Copyright (C) 2006 Breach Security Inc. All rights reserved.
-#
-# The ModSecuirty Core Rule Set is distributed under GPL version 2
-# Please see the enclosed LICENCE file for full details.
-# ---------------------------------------------------------------
-
-
-#
-# TODO in some cases a valid client (usually automated) generates requests that
-# violates the HTTP protocol. Create exceptions for those clients, but try
-# to limit the exception to a source IP or other additional properties of
-# the request such as URL and not allow the violation generally.
-#
-#
-
-# Use status code 400 response status code by default as protocol violations
-# are in essence bad requests.
-SecDefaultAction "log,pass,phase:1,status:400"
-
-# Accept only digits in content length
-#
-SecRule REQUEST_HEADERS:Content-Length "!^\d+$" "deny,log,auditlog,status:400,msg:'Content-Length HTTP header is not numeric', severity:'2',id:'960016'"
-
-# Do not accept GET or HEAD requests with bodies
-# HTTP standard allows GET requests to have a body but this
-# feature is not used in real life. Attackers could try to force
-# a request body on an unsuspecting web applications.
-#
-SecRule REQUEST_METHOD "^(GET|HEAD)$" "chain,deny,log,auditlog,status:400,msg:'GET or HEAD requests with bodies', severity:'2',id:'960011'"
-SecRule REQUEST_HEADERS:Content-Length "!^0?$"
-
-# Require Content-Length to be provided with every POST request.
-#
-SecRule REQUEST_METHOD "^POST$" "chain,deny,log,auditlog,status:400,msg:'POST request must have a Content-Length header',id:'960012',severity:'4'"
-SecRule &REQUEST_HEADERS:Content-Length "@eq 0"
-
-# Don't accept transfer encodings we know we don't know how to handle
-#
-# NOTE ModSecurity does not support chunked transfer encodings at
-# this time. You MUST reject all such requests.
-#
-SecRule HTTP_Transfer-Encoding "!^$" "deny,log,auditlog,status:501,msg:'ModSecurity does not support transfer encodings',id:'960013',severity:'5'"
-
-# Check decodings
-SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "@validateUrlEncoding" \
- "chain, deny,log,auditlog,status:400,msg:'URL Encoding Abuse Attack Attempt',id:'950107',severity:'4'"
-SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "\%(?![0-9a-fA-F]{2}|u[0-9a-fA-F]{4})"
-
-SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "@validateUtf8Encoding" "deny,log,auditlog,status:400,msg:'UTF8 Encoding Abuse Attack Attempt',id:'950801',severity:'4'"
-
-# Proxy access attempt
-# NOTE Apache blocks such access by default if not set as a proxy. The rule is
-# included in case Apache proxy is misconfigured.
-SecRule REQUEST_URI ^http:/ "deny,log,auditlog,status:400,msg:'Proxy access attempt', severity:'2',id:'960014'"
-
-#
-# Restrict type of characters sent
-#
-# NOTE In order to be broad and support localized applications this rule
-# only validates that NULL Is not used.
-#
-# The strict policy version also validates that protocol and application
-# generated fields are limited to printable ASCII.
-#
-# TODO If your application use the range 32-126 for parameters.
-#
-SecRule REQUEST_FILENAME|REQUEST_HEADERS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer \
- "@validateByteRange 32-126" \
- "deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',t:urlDecodeUni,phase:1"
-
-SecRule ARGS|ARGS_NAMES "@validateByteRange 1-255" \
- "deny,log,auditlog,status:400,msg:'Invalid character in request',id:'960901',severity:'4',t:urlDecodeUni,phase:2"
+# ---------------------------------------------------------------
+# Core ModSecurity Rule Set
+# Copyright (C) 2006 Breach Security Inc. All rights reserved.
+#
+# The ModSecuirty Core Rule Set is distributed under GPL version 2
+# Please see the enclosed LICENCE file for full details.
+# ---------------------------------------------------------------
+
+
+#
+# TODO in some cases a valid client (usually automated) generates requests that
+# violates the HTTP protocol. Create exceptions for those clients, but try
+# to limit the exception to a source IP or other additional properties of
+# the request such as URL and not allow the violation generally.
+#
+#
+
+# Use status code 400 response status code by default as protocol violations
+# are in essence bad requests.
+SecDefaultAction "log,pass,phase:2,status:400"
+
+# Validate request line
+#
+SecRule REQUEST_LINE "!^[a-z]{3,10}\s*(?:\w{3,7}?\:\/\/[\w\-\.\/]*)??\/[\w\-\.\/~%:@&=+$,;]*(?:\?[\S]*)??\s*http\/\d\.\d$" \
+ "t:none,t:lowercase,deny,log,auditlog,status:400,msg:'Invalid HTTP Request Line',,id:'960911',severity:'2'"
+
+
+# HTTP Request Smuggling
+#
+SecRule REQUEST_HEADERS:'/(Content-Length|Transfer-Encoding)/' "," "deny,log,auditlog,status:400,msg:'HTTP Request Smuggling Attack.',,id:'950012',severity:'1'"
+
+# Block request with malformed content.
+# ModSecurity will not inspect these, but the server application might do so
+#
+SecRule REQBODY_PROCESSOR_ERROR "!@eq 0" "t:none,deny,log,auditlog,status:400,msg:'Invalid request body',,id:'960912',severity:'2'"
+
+
+# Accept only digits in content length
+#
+SecRule REQUEST_HEADERS:Content-Length "!^\d+$" "deny,log,auditlog,status:400,msg:'Content-Length HTTP header is not numeric', severity:'2',,id:'960016',"
+
+# Do not accept GET or HEAD requests with bodies
+# HTTP standard allows GET requests to have a body but this
+# feature is not used in real life. Attackers could try to force
+# a request body on an unsuspecting web applications.
+#
+SecRule REQUEST_METHOD "^(?:GET|HEAD)$" "chain,deny,log,auditlog,status:400,msg:'GET or HEAD requests with bodies', severity:'2',,id:'960011',"
+SecRule REQUEST_HEADERS:Content-Length "!^0?$"
+
+# Require Content-Length to be provided with every POST request.
+#
+SecRule REQUEST_METHOD "^POST$" "chain,deny,log,auditlog,status:400,msg:'POST request must have a Content-Length header',,id:'960012',severity:'4'"
+SecRule &REQUEST_HEADERS:Content-Length "@eq 0"
+
+# Don't accept transfer encodings we know we don't know how to handle
+#
+# NOTE ModSecurity does not support chunked transfer encodings at
+# this time. You MUST reject all such requests.
+#
+SecRule REQUEST_HEADERS:Transfer-Encoding "!^$" "deny,log,auditlog,status:501,msg:'ModSecurity does not support transfer encodings',,id:'960013',severity:'3'"
+
+# Check decodings
+SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "@validateUrlEncoding" \
+ "chain, deny,log,auditlog,status:400,msg:'URL Encoding Abuse Attack Attempt',,id:'950107',severity:'4'"
+SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "\%(?!$|\W|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})"
+
+SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "@validateUtf8Encoding" "deny,log,auditlog,status:400,msg:'UTF8 Encoding Abuse Attack Attempt',,id:'950801',severity:'4'"
+
+# Disallow use of full-width unicode
+SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "\%u[fF]{2}[0-9a-fA-F]{2}" \
+ "t:none,deny,log,auditlog,status:400,msg:'Unicode Full/Half Width Abuse Attack Attempt',,id:'950116',severity:'4'"
+
+# Proxy access attempt
+# NOTE Apache blocks such access by default if not set as a proxy. The rule is
+# included in case Apache proxy is misconfigured.
+SecRule REQUEST_URI_RAW ^\w+:/ "deny,log,auditlog,status:400,msg:'Proxy access attempt', severity:'2',,id:'960014',"
+
+#
+# Restrict type of characters sent
+#
+# NOTE In order to be broad and support localized applications this rule
+# only validates that NULL Is not used.
+#
+# The strict policy version also validates that protocol and application
+# generated fields are limited to printable ASCII.
+#
+# TODO If your application use the range 32-126 for parameters.
+#
+SecRule REQUEST_FILENAME|REQUEST_HEADERS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer \
+ "@validateByteRange 32-126" \
+ "deny,log,auditlog,status:400,msg:'Invalid character in request',,id:'960018',severity:'4',t:urlDecodeUni"
+
+SecRule ARGS|ARGS_NAMES|REQUEST_HEADERS:Referer "@validateByteRange 1-255" \
+ "deny,log,auditlog,status:400,msg:'Invalid character in request',,id:'960901',severity:'4',t:urlDecodeUni"
diff --git a/rules/blocking/modsecurity_crs_21_protocol_anomalies.conf b/rules/blocking/modsecurity_crs_21_protocol_anomalies.conf
index 03084e36..3ac16ce5 100644
--- a/rules/blocking/modsecurity_crs_21_protocol_anomalies.conf
+++ b/rules/blocking/modsecurity_crs_21_protocol_anomalies.conf
@@ -1,50 +1,62 @@
-# ---------------------------------------------------------------
-# Core ModSecurity Rule Set
-# Copyright (C) 2006 Breach Security Inc. All rights reserved.
-#
-# The ModSecuirty Core Rule Set is distributed under GPL version 2
-# Please see the enclosed LICENCE file for full details.
-# ---------------------------------------------------------------
-
-
-#
-# TODO in some cases a valid client (usually automated) generates requests that
-# violates the HTTP protocol. Create exceptions for those clients, but try
-# to limit the exception to a source IP or other additional properties of
-# the request such as URL and not allow the violation generally.
-#
-
-# Use status code 400 response status code by default as protocol violations
-# are in essence bad requests.
-SecDefaultAction "log,pass,phase:1,status:400"
-
-# Do not accept requests without common headers.
-#
-# Implies either an attacker or a legitimate automation client.
-#
-SecRule REQUEST_URI "^/$" "chain,skip:4"
-SecRule REMOTE_ADDR "^127\.0\.0\.1$" "chain"
-SecRule REQUEST_HEADERS:User-Agent "^Apache.*\(internal dummy connection\)$" "t:none"
-
-SecRule &REQUEST_HEADERS:Host "@eq 0" \
- "skip:1,deny,log,auditlog,status:400,msg:'Request Missing a Host Header',id:'960008',severity:'4'"
-SecRule REQUEST_HEADERS:Host "^$" \
- "deny,log,auditlog,status:400,msg:'Request Missing a Host Header',id:'960008',severity:'4'"
-
-
-SecRule &REQUEST_HEADERS:Accept "@eq 0" \
- "chain,skip:1,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015'"
-SecRule REQUEST_METHOD "!OPTIONS"
-SecRule REQUEST_HEADERS:Accept "^$" \
- "chain,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015'"
-SecRule REQUEST_METHOD "!OPTIONS"
-
-SecRule &REQUEST_HEADERS:User-Agent "@eq 0" \
- "skip:1,deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',id:'960009',severity:'4'"
-SecRule REQUEST_HEADERS:User-Agent "^$" \
- "deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',id:'960009',severity:'4'"
-
-
-# Check that the host header is not an IP address
-#
-SecRule REQUEST_HEADERS:Host "^[\d\.]+$" "deny,log,auditlog,status:400,msg:'Host header is a numeric IP address', severity:'2',id:'960017'"
+# ---------------------------------------------------------------
+# Core ModSecurity Rule Set
+# Copyright (C) 2006 Breach Security Inc. All rights reserved.
+#
+# The ModSecuirty Core Rule Set is distributed under GPL version 2
+# Please see the enclosed LICENCE file for full details.
+# ---------------------------------------------------------------
+
+
+#
+# TODO in some cases a valid client (usually automated) generates requests that
+# violates the HTTP protocol. Create exceptions for those clients, but try
+# to limit the exception to a source IP or other additional properties of
+# the request such as URL and not allow the violation generally.
+#
+
+# Use status code 400 response status code by default as protocol violations
+# are in essence bad requests.
+SecDefaultAction "log,pass,phase:2,status:400"
+
+# Do not accept requests without common headers.
+#
+# Implies either an attacker or a legitimate automation client.
+#
+SecRule REQUEST_URI "^/$" "chain,skip:4"
+SecRule REMOTE_ADDR "^127\.0\.0\.1$" "chain"
+SecRule REQUEST_HEADERS:User-Agent "^Apache.*\(internal dummy connection\)$" "t:none"
+
+SecRule &REQUEST_HEADERS:Host "@eq 0" \
+ "skip:1,deny,log,auditlog,status:400,msg:'Request Missing a Host Header',,id:'960008',severity:'4'"
+SecRule REQUEST_HEADERS:Host "^$" \
+ "deny,log,auditlog,status:400,msg:'Request Missing a Host Header',,id:'960008',severity:'4'"
+
+
+SecRule &REQUEST_HEADERS:Accept "@eq 0" \
+ "chain,skip:1,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',,id:'960015',"
+SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"
+SecRule REQUEST_HEADERS:Accept "^$" \
+ "chain,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',,id:'960015',"
+SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"
+
+SecRule &REQUEST_HEADERS:User-Agent "@eq 0" \
+ "skip:1,deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',,id:'960009',severity:'4'"
+SecRule REQUEST_HEADERS:User-Agent "^$" \
+ "deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',,id:'960009',severity:'4'"
+
+
+SecRule &REQUEST_HEADERS:Content-Type "@eq 0" \
+ "chain,deny,log,auditlog,status:400,msg:'Request Containing Content, but Missing Content-Type header',,id:'960904',severity:'4'"
+SecRule REQUEST_HEADERS:Content-Length "!^0$"
+
+
+# Check that the host header is not an IP address
+#
+SecRule REQUEST_HEADERS:Host "^[\d\.]+$" "deny,log,auditlog,status:400,msg:'Host header is a numeric IP address', severity:'2',,id:'960017',"
+
+
+# Log a security event when the request is rejected by apache
+#
+SecRule RESPONSE_STATUS ^400$ "t:none,phase:5,chain,log,auditlog,msg:'Invalid request',,id:'960913',severity:'2'"
+SecRule WEBSERVER_ERROR_LOG !ModSecurity
+
diff --git a/rules/blocking/modsecurity_crs_40_generic_attacks.conf b/rules/blocking/modsecurity_crs_40_generic_attacks.conf
index dc3a9e7e..8c999342 100644
--- a/rules/blocking/modsecurity_crs_40_generic_attacks.conf
+++ b/rules/blocking/modsecurity_crs_40_generic_attacks.conf
@@ -1,83 +1,94 @@
-# ---------------------------------------------------------------
-# Core ModSecurity Rule Set
-# Copyright (C) 2006 Breach Security Inc. All rights reserved.
-#
-# The ModSecuirty Core Rule Set is distributed under GPL version 2
-# Please see the enclosed LICENCE file for full details.
-# ---------------------------------------------------------------
-
-
-#
-# TODO While some of the pattern groups such as command injection are usually
-# safe of false positives, other pattern groups such as SQL injection and
-# XSS may require setting exceptions and therefore are set to log only by
-# default.
-#
-# Start ModSecurity in monitoring only mode and check whether your
-# application requires exceptions for a specific URL, Pattern or source IP
-# before moving to blocking mode.
-
-SecDefaultAction "log,pass,phase:2,status:500,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase"
-
-# Session fixation
-SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "(?:\.cookie\b.*?;\W*?(?:expires|domain)\W*?=|\bhttp-equiv\W+set-cookie\b)" \
- "capture,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'Session Fixation. Matched signature <%{TX.0}>',id:'950009',severity:'2'"
-
-# Blind SQL injection
-SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "(?:\b(?:(?:s(?:ys\.(?:user_(?:(?:t(?:ab(?:_column|le)|rigger)|object|view)s|c(?:onstraints|atalog))|all_tables|tab)|elect\b.{0,40}\b(?:substring|ascii|user))|m(?:sys(?:(?:queri|ac)e|relationship|column|object)s|ysql.user)|c(?:onstraint_type|harindex)|attnotnull)\b|(?:locate|instr)\W+\()|\@\@spid\b)" \
- "capture,t:replaceComments,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'Blind SQL Injection Attack. Matched signature <%{TX.0}>',id:'950007',severity:'2'"
-#SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "\b(?:benchmark|encode)\b" \
-# "chain,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'Blind SQL Injection Attack. Matched signature <%{TX.0}>',id:'950903',severity:'2'"
-#SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "[\\(\)\%#]\|--"
-SecRule REQUEST_FILENAME|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "\b(?:(?:s(?:ys(?:(?:(?:process|tabl)e|filegroup|object)s|c(?:o(?:nstraint|lumn)s|at)|dba|ibm)|ubstr(?:ing)?)|user_(?:(?:(?:constrain|objec)t|tab(?:_column|le)|ind_column|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|(?:dba|mb)_users|xtype\W+\bchar|rownum)\b|t(?:able_name\b|extpos\W+\())" \
- "capture,t:replaceComments,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'Blind SQL Injection Attack. Matched signature <%{TX.0}>',id:'950904',severity:'2'"
-
-# SQL injection
-SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "(?:\b(?:(?:s(?:elect\b(?:.{1,100}?\b(?:(?:length|count|top)\b.{1,100}?\bfrom|from\b.{1,100}?\bwhere)|.*?\b(?:d(?:ump\b.*\bfrom|ata_type)|(?:to_(?:numbe|cha)|inst)r))|p_(?:(?:addextendedpro|sqlexe)c|(?:oacreat|prepar)e|execute(?:sql)?|makewebtask)|ql_(?:longvarchar|variant))|xp_(?:reg(?:re(?:movemultistring|ad)|delete(?:value|key)|enum(?:value|key)s|addmultistring|write)|e(?:xecresultset|numdsn)|(?:terminat|dirtre)e|availablemedia|loginconfig|cmdshell|filelist|makecab|ntsec)|u(?:nion\b.{1,100}?\bselect|tl_(?:file|http))|group\b.*\bby\b.{1,100}?\bhaving|load\b\W*?\bdata\b.*\binfile|(?:n?varcha|tbcreato)r|autonomous_transaction|open(?:rowset|query)|dbms_java)\b|i(?:n(?:to\b\W*?\b(?:dump|out)file|sert\b\W*?\binto|ner\b\W*?\bjoin)\b|(?:f(?:\b\W*?\(\W*?\bbenchmark|null\b)|snull\b)\W*?\()|(?:having|or|and)\b\s+?(?:\d{1,10}|'[^=]{1,10}')\s*?[=<>]+|(?:print\]\b\W*?\@|root)\@|c(?:ast\b\W*?\(|oalesce\b))|(?:;\W*?\b(?:shutdown|drop)|\@\@version)\b|'(?:s(?:qloledb|a)|msdasql|dbo)')" \
- "capture,t:replaceComments,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'SQL Injection Attack. Matched signature <%{TX.0}>',id:'950001',severity:'2'"
-#SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "\b(?:rel(?:(?:nam|typ)e|kind)|a(?:ttn(?:ame|um)|scii)|c(?:o(?:nver|un)t|ha?r)|s(?:hutdown|elect)|to_(?:numbe|cha)r|u(?:pdate|nion)|d(?:elete|rop)|group\b\W*\bby|having|insert|length|where)\b" \
-# "chain,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'SQL Injection Attack. Matched signature <%{TX.0}>',id:'950905',severity:'2'"
-#SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "[\\(\)\%#]\|--"
-SecRule REQUEST_FILENAME|ARGS|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "\b(?:user_(?:(?:object|table|user)s|password|group)|a(?:tt(?:rel|typ)id|ll_objects)|object_(?:(?:nam|typ)e|id)|pg_(?:attribute|class)|column_(?:name|id)|substr(?:ing)?|table_name|mb_users|rownum)\b" \
- "capture,t:replaceComments,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'SQL Injection Attack. Matched signature <%{TX.0}>',id:'950906',severity:'2'"
-
-# XSS
-SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS "(?:\b(?:on(?:(?:mo(?:use(?:o(?:ver|ut)|down|move|up)|ve)|key(?:press|down|up)|c(?:hange|lick)|s(?:elec|ubmi)t|(?:un)?load|dragdrop|resize|focus|blur)\b\W*?=|abort\b)|(?:l(?:owsrc\b\W*?\b(?:(?:java|vb)script|shell)|ivescript)|(?:href|url)\b\W*?\b(?:(?:java|vb)script|shell)|background-image|mocha):|type\b\W*?\b(?:text\b(?:\W*?\b(?:j(?:ava)?|ecma)script\b| [vbscript])|application\b\W*?\bx-(?:java|vb)script\b)|s(?:(?:tyle\b\W*=.*\bexpression\b\W*|ettimeout\b\W*?)\(|rc\b\W*?\b(?:(?:java|vb)script|shell|http):)|(?:c(?:opyparentfolder|reatetextrange)|get(?:special|parent)folder)\b|a(?:ctivexobject\b|lert\b\W*?\())|<(?:(?:body\b.*?\b(?:backgroun|onloa)d|input\b.*?\\btype\b\W*?\bimage)\b|!\[CDATA\[|script|meta)|(?:\.(?:(?:execscrip|addimpor)t|(?:fromcharcod|cooki)e|innerhtml)|\@import)\b)" \
- "capture,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'Cross-site Scripting (XSS) Attack. Matched signature <%{TX.0}>',id:'950004',severity:'2'"
-
-# file injection
-SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS "(?:\b(?:\.(?:ht(?:access|passwd|group)|www_?acl)|global\.asa|httpd\.conf|boot\.ini)\b|\/etc\/)" \
- "capture,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'Remote File Access Attempt. Matched signature <%{TX.0}>',id:'950005',severity:'2'"
-
-# Command access
-SecRule REQUEST_FILENAME "\b(?:n(?:map|et|c)|w(?:guest|sh)|cmd(?:32)?|telnet|rcmd|ftp)\.exe\b" \
- "capture,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'System Command Access. Matched signature <%{TX.0}>',id:'950002',severity:'2'"
-
-# Command injection
-SecRule ARGS|ARGS_NAMES|REQUEST_HEADERS "(?:\b(?:(?:n(?:et(?:\b\W+?\blocalgroup|\.exe)|(?:map|c)\.exe)|t(?:racer(?:oute|t)|elnet\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\.exe|echo\b\W*?\by+)\b|c(?:md(?:(?:32)?\.exe\b|\b\W*?\/c)|d(?:\b\W*?[\\\/]|\W*?\.\.)|hmod.{0,40}?\+.{0,3}x))|[\;\|\`]\W*?\b(?:(?:c(?:h(?:grp|mod|own|sh)|md|pp|c)|p(?:asswd|ython|erl|ing|s)|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)\b|g(?:\+\+|cc\b))|\/(?:c(?:h(?:grp|mod|own|sh)|pp|c)|p(?:asswd|ython|erl|ing|s)|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|g(?:\+\+|cc)|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)(?:[\'\"\|\;\`\-\s]|$))" \
- "capture,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'System Command Injection. Matched signature <%{TX.0}>',id:'950006',severity:'2'"
-SecRule "ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:User-Agent" \
- "\bwget\b" \
- "capture,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'System Command Injection. Matched signature <%{TX.0}>',id:'950907',severity:'2'"
-
-# Coldfusion injection
-SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS "\bcf(?:usion_(?:d(?:bconnections_flush|ecrypt)|set(?:tings_refresh|odbcini)|getodbc(?:dsn|ini)|verifymail|encrypt)|_(?:(?:iscoldfusiondatasourc|getdatasourceusernam)e|setdatasource(?:password|username))|newinternal(?:adminsecurit|registr)y|admin_registry_(?:delete|set)|internaldebug)\b" \
- "capture,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'Injection of Undocumented ColdFusion Tags. Matched signature <%{TX.0}>',id:'950008',severity:'2'"
-
-# LDAP injection
-SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS|!REQUEST_HEADERS:Referer "(?:\((?:\W*?(?:objectc(?:ategory|lass)|homedirectory|[gu]idnumber|cn)\b\W*?=|[^\w\x80-\xFF]*?[\!\&\|][^\w\x80-\xFF]*?\()|\)[^\w\x80-\xFF]*?\([^\w\x80-\xFF]*?[\!\&\|])" \
- "capture,ctl:auditLogParts=+E,deny,log,auditlog,status:501,msg:'LDAP Injection Attack. Matched signature <%{TX.0}>',id:'950010',severity:'2'"
-
-# SSI injection
-SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|REQUEST_HEADERS "