clawbot
e16f454d58
check / check (push) In progress
Adds vaultwarden.conf, the thirteenth change, with rule ids 900150 to 900153. On Vaultwarden's account, organization and admin paths, names and password hints skip 930120, 932120, 932250 and 932260, and so does a security key's name. Email addresses skip 930120, 932120 and 932260 there, on the two-factor email paths and when signing in with another device. So does the address of the admin page's test email. The data breach report's address does too. The encrypted names of uploaded attachments and file sends skip 920120. Requests recorded from Vaultwarden 1.37.5 through the web vault, the Bitwarden command line client and the admin page pass at the defaults and while bodies are read. Model: opus-5-5
85 lines
5.5 KiB
Plaintext
85 lines
5.5 KiB
Plaintext
# The thirteenth change: on Vaultwarden's paths, some fields skip the rules that
|
|
# refused ordinary Vaultwarden requests there. They are the fields where
|
|
# Vaultwarden receives a name, a password hint or an email address in plain
|
|
# text, and the names of uploaded files. Each exclusion runs with the request,
|
|
# before the rules it switches off, so this file is loaded before the Core Rule
|
|
# Set's rules. Each comment names a request a rule refused. An exclusion on a
|
|
# field of a body applies only when the query has no parameter of that name, so
|
|
# it matters only while SWW_WAF_BODY_LIMIT is set.
|
|
#
|
|
# The apps encrypt the names, notes, addresses and file names of vault items,
|
|
# folders, collections and sends before they send them. These values pass
|
|
# without exclusions.
|
|
#
|
|
# Four rules read a name or a hint as a command or a system file:
|
|
# 930120: .htaccess
|
|
# 932120: powershell
|
|
# 932250: ls -la
|
|
# 932260: python3
|
|
|
|
# Names and password hints, in JSON bodies, skip the four rules:
|
|
# name: signing up, editing the account's profile, and creating or renaming
|
|
# an organization or a group, "python3 .htaccess team"
|
|
# name: naming a security key at /api/two-factor/webauthn, "python3 key"
|
|
# masterPasswordHint: signing up or changing the master password,
|
|
# "the .htaccess one, not powershell"
|
|
# invitation_org_name, smtp_from_name: saving the admin page's settings,
|
|
# "ls -la and .htaccess vault"
|
|
# Drupal serves /admin/config too, but sends no JSON there.
|
|
SecRule REQUEST_FILENAME "@rx ^/identity/accounts/|^/api/(?:accounts|emergency-access|organizations)(?:/|$)|^/api/two-factor/webauthn$|^/admin/config$" \
|
|
"id:900150,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^json\.(?:name|masterpasswordhint|invitation_org_name|smtp_from_name)$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:name|masterpasswordhint|invitation_org_name|smtp_from_name)$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:name|masterpasswordhint|invitation_org_name|smtp_from_name)$/,\
|
|
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:name|masterpasswordhint|invitation_org_name|smtp_from_name)$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:name|masterpasswordhint|invitation_org_name|smtp_from_name)$/"
|
|
|
|
# Email addresses, in bodies, skip 930120, 932120 and 932260, which refused
|
|
# these addresses:
|
|
# 930120: jane.profile@example.com
|
|
# 932120: powershell@example.com
|
|
# 932260: python3.dev@example.com
|
|
# These fields hold an address:
|
|
# username: signing in at /identity/connect/token, in form data
|
|
# email: signing up, asking for the password hint, inviting an emergency
|
|
# contact, and inviting a user from the admin page
|
|
# email: setting up sign-in codes by email, and asking for one when signing
|
|
# in, under /api/two-factor/
|
|
# email: signing in with another device, at /api/auth-requests
|
|
# email: sending the admin page's test email, at /admin/test/smtp
|
|
# salt fields, such as masterPasswordUnlock.salt: signing up and changing
|
|
# the master password, which send the address as the salt
|
|
# accountUnlockData.masterPasswordUnlockData.email: rotating the account's
|
|
# encryption key
|
|
# newEmail: changing the account's address
|
|
# billingEmail: creating or editing an organization
|
|
# emails: inviting members to an organization
|
|
# smtp_from, smtp_username, org_creation_users: saving the admin page's
|
|
# settings
|
|
# An address holds no spaces, so it keeps 932250, which needs ls -la.
|
|
SecRule REQUEST_FILENAME "@rx ^/identity/(?:connect/token$|accounts/)|^/api/(?:accounts|emergency-access|organizations|auth-requests)(?:/|$)|^/api/two-factor/|^/admin/(?:config|invite|test/smtp)$" \
|
|
"id:900151,phase:1,pass,nolog,chain"
|
|
SecRule &ARGS_GET:/^(?:username|json\.(?:email|newemail|billingemail|emails\.\d+|smtp_from|smtp_username|org_creation_users|(?:[a-z]+\.)+salt|accountunlockdata\.masterpasswordunlockdata\.email))$/ "@eq 0" \
|
|
"ctl:ruleRemoveTargetById=930120;ARGS:/^(?:username|json\.(?:email|newemail|billingemail|emails\.\d+|smtp_from|smtp_username|org_creation_users|(?:[a-z]+\.)+salt|accountunlockdata\.masterpasswordunlockdata\.email))$/,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:username|json\.(?:email|newemail|billingemail|emails\.\d+|smtp_from|smtp_username|org_creation_users|(?:[a-z]+\.)+salt|accountunlockdata\.masterpasswordunlockdata\.email))$/,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:username|json\.(?:email|newemail|billingemail|emails\.\d+|smtp_from|smtp_username|org_creation_users|(?:[a-z]+\.)+salt|accountunlockdata\.masterpasswordunlockdata\.email))$/"
|
|
|
|
# The data breach report sends an address in the query, which skips the same
|
|
# three rules: /api/hibp/breach?username=jane.profile%40example.com.
|
|
SecRule REQUEST_FILENAME "@rx ^/api/hibp/breach$" \
|
|
"id:900152,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=930120;ARGS:username,\
|
|
ctl:ruleRemoveTargetById=932120;ARGS:username,\
|
|
ctl:ruleRemoveTargetById=932260;ARGS:username"
|
|
|
|
# An uploaded attachment or file send is named by its encrypted name, such as
|
|
# "2.4Hw+ulOz7BLrP+NSaLKhGw==|9nlpuuYHog6rpJrR...". 920120 refused the "=" in
|
|
# it, so the names of uploaded files skip 920120 on these paths:
|
|
# /api/ciphers/<id>/attachment/<attachment id>, and the older uploads to
|
|
# /api/ciphers/<id>/attachment, /api/ciphers/<id>/attachment-admin and
|
|
# /api/ciphers/<id>/attachment/<attachment id>/share
|
|
# /api/sends/<id>/file/<file id>
|
|
SecRule REQUEST_FILENAME "@rx ^/api/ciphers/[0-9a-f-]{36}/attachment(?:-admin|/[0-9a-f]+(?:/share)?)?$|^/api/sends/[0-9a-f-]{36}/file/[0-9a-f]+$" \
|
|
"id:900153,phase:1,pass,nolog,\
|
|
ctl:ruleRemoveTargetById=920120;FILES"
|