rules/optional_rules/modsecurity_crs_21_protocol_anomalies.conf

   1 # ---------------------------------------------------------------
   2 # Core ModSecurity Rule Set ver.1.6.1
   3 # Copyright (C) 2006-2007 Breach Security Inc. All rights reserved.
   4 #
   5 # The ModSecuirty Core Rule Set is distributed under GPL version 2
   6 # Please see the enclosed LICENCE file for full details.
   7 # ---------------------------------------------------------------
   8
   9
  10 #
  11 # TODO in some cases a valid client (usually automated) generates requests that
  12 #      violates the HTTP protocol. Create exceptions for those clients, but try
  13 #      to limit the exception to a source IP or other additional properties of
  14 #      the request such as URL and not allow the violation generally.
  15 #
  16
  17 # Do not accept requests without common headers.
  18 # Implies either an attacker or a legitimate automation client.
  19 #
  20 # Exception for Apache SSL pinger
  21
  22 SecRule REQUEST_LINE "^GET /$" "chain,phase:2,t:none,pass,nolog,ctl:ruleRemoveById=960019,ctl:ruleRemoveById=960008,ctl:ruleRemoveById=960015,ctl:ruleRemoveById=960009,id:'999210',severity:'5'"
  23 SecRule REMOTE_ADDR "^127\.0\.0\.1$" t:none
  24
  25 # Exception for Apache internal dummy connection
  26 SecRule REQUEST_LINE "^GET / HTTP/1.0$" "chain,phase:2,t:none,pass,nolog,ctl:ruleRemoveById=960019,ctl:ruleRemoveById=960008,ctl:ruleRemoveById=960015,ctl:ruleRemoveById=960009,id:'999211',severity:'5'"
  27 SecRule REMOTE_ADDR "^127\.0\.0\.1$" "chain,t:none"
  28 SecRule REQUEST_HEADERS:User-Agent "^Apache.*\(internal dummy connection\)$" "t:none"
  29
  30
  31 # Detect HTTP/0.9 Requests
  32 SecRule REQUEST_PROTOCOL ^http/0.9$ "t:none,t:lowercase,phase:2,deny,log,auditlog,status:400,msg:'HTTP/0.9 Request Detected',id:'960019',severity:'4'"
  33
  34 SecRule &REQUEST_HEADERS:Host "@eq 0" \
  35     "skip:1,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing a Host Header',id:'960008',tag:'PROTOCOL_VIOLATION/MISSING_HEADER',severity:'4'"
  36 SecRule REQUEST_HEADERS:Host "^$" \
  37     "phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing a Host Header',id:'960008',tag:'PROTOCOL_VIOLATION/MISSING_HEADER',severity:'4'"
  38
  39
  40 SecRule &REQUEST_HEADERS:Accept "@eq 0" \
  41     "chain,phase:2,skip:1,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
  42 SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"
  43 SecRule REQUEST_HEADERS:Accept "^$" \
  44     "chain,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing an Accept Header', severity:'2',id:'960015',tag:'PROTOCOL_VIOLATION/MISSING_HEADER'"
  45 SecRule REQUEST_METHOD "!^OPTIONS$" "t:none"
  46
  47 SecRule &REQUEST_HEADERS:User-Agent "@eq 0" \
  48     "skip:1,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',id:'960009',tag:'PROTOCOL_VIOLATION/MISSING_HEADER',severity:'4'"
  49 SecRule REQUEST_HEADERS:User-Agent "^$" \
  50     "t:none,deny,log,auditlog,status:400,msg:'Request Missing a User Agent Header',id:'960009',tag:'PROTOCOL_VIOLATION/MISSING_HEADER',severity:'4'"
  51
  52
  53 SecRule &REQUEST_HEADERS:Content-Type "@eq 0" \
  54     "chain,phase:2,t:none,deny,log,auditlog,status:400,msg:'Request Containing Content, but Missing Content-Type header',id:'960904',severity:'4'"
  55 SecRule REQUEST_HEADERS:Content-Length "!^0$" "t:none"
  56
  57
  58 # Check that the host header is not an IP address
  59 #
  60 SecRule REQUEST_HEADERS:Host "^[\d\.]+$" "phase:2,t:none,deny,log,auditlog,status:400,msg:'Host header is a numeric IP address', severity:'2',id:'960017',tag:'PROTOCOL_VIOLATION/IP_HOST'"
  61
  62
  63 # Log a security event when the request is rejected by apache
  64 #
  65 SecRule RESPONSE_STATUS ^400$ "t:none,phase:5,chain,log,auditlog,pass,msg:'Invalid request',id:'960913',severity:'2'"
  66 SecRule WEBSERVER_ERROR_LOG !ModSecurity "t:none"
  67