Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🐛 urls with .profile in them are triggering a modsec rule resulting in a 403 page forbidden error #982

Closed
LavMatt opened this issue Oct 24, 2024 · 4 comments
Closed

🐛 urls with .profile in them are triggering a modsec rule resulting in a 403 page forbidden error #982

LavMatt opened this issue Oct 24, 2024 · 4 comments
Assignees
@mitchdawson1982
Labels
bug Something isn't working

Comments

@LavMatt
Copy link
Contributor

LavMatt commented Oct 24, 2024

Describe the bug.

It appears urls for details of tables in find moj data that start profile are triggering a modsec ingress rule that blocks the page being displayed with a 403 error.

This is across all environments

The modsec logs indicate the rule id doing the block is 949110 (Inbound Anomaly Score Exceeded)

2024/10/24 10:48:44 [error] 395872#395872: *46651044 [client 35.176.93.186] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "81"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.3.5"] [maturity "0"] [accuracy "0"] [tag "github_team=data-catalogue"] [tag "application-multi"]

However, this is going to be more complicated to properly understand and mitigate because the rule is an aggregation of scores from other rules and we can't disable or override the 949110 rule, we'll need to dig into it and find the rule(s) which is(are) triggered

To Reproduce

No response

Expected Behaviour

No response

Additional context

No response
@LavMatt LavMatt added the bug Something isn't working label Oct 24, 2024
@LavMatt LavMatt moved this to Todo in Data Catalogue Oct 24, 2024
@mitchdawson1982 mitchdawson1982 self-assigned this Oct 24, 2024
@mitchdawson1982
Copy link
Collaborator

mitchdawson1982 commented Oct 24, 2024 •
edited
Loading

Failing Examples

2024/10/24 10:48:44 [error] 395872#395872: *46651044 [client 35.176.93.186] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator Ge' with parameter 5' against variable TX:ANOMALY_SCORE' (Value: 5' ) [file "/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "81"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver "OWASP_CRS/3.3.5"] [maturity "0"] [accuracy "0"] [tag "github_team=data-catalogue"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "172.20.210.146"] [uri "/details/table/urn:li:dataset:(urn:li:dataPlatform:dbt,cadet.awsdatacatalog.nomis_ao_dev_dbt.profiles,PROD)"] [unique_id "172976692490.111309"] [ref ""], client: 35.176.93.186, server: dev.find-moj-data.service.justice.gov.uk, request: "GET /details/table/urn:li:dataset:(urn:li:dataPlatform:dbt,cadet.awsdatacatalog.nomis_ao_dev_dbt.profiles,PROD) HTTP/2.0", host: "dev.find-moj-data.service.justice.gov.uk", referrer: "https://dev.find-moj-data.service.justice.gov.uk/pagination/1?query=profile"

@mitchdawson1982
Copy link
Collaborator

mitchdawson1982 commented Oct 25, 2024 •
edited
Loading

@mitchdawson1982
Copy link
Collaborator 

{
    "transaction": {
        "client_ip": "35.176.93.186",
        "time_stamp": "Fri Oct 25 15:14:26 2024",
        "server_id": "e9991f0bc8e68c08bcb04fe43698297c017fca69",
        "client_port": 63185,
        "host_ip": "172.20.171.236",
        "host_port": 443,
        "unique_id": "172986926676.560105",
        "request": {
            "method": "GET",
            "http_version": 2.0,
            "uri": "/details/table/urn:li:dataset:(urn:li:dataPlatform:dbt,cadet.awsdatacatalog.nomis_sensitive.profile_types,PROD)"
        },
        "response": {
            "body": "<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n<!-- a padding to disable MSIE and Chrome friendly error page -->\r\n<!-- a padding to disable MSIE and Chrome friendly error page -->\r\n<!-- a padding to disable MSIE and Chrome friendly error page -->\r\n<!-- a padding to disable MSIE and Chrome friendly error page -->\r\n<!-- a padding to disable MSIE and Chrome friendly error page -->\r\n<!-- a padding to disable MSIE and Chrome friendly error page -->\r\n",
            "http_code": 403,
            "headers": {
                "Server": "",
                "Server": "",
                "Date": "Fri, 25 Oct 2024 15:14:26 GMT",
                "Content-Length": "548",
                "Content-Type": "text/html",
                "Connection": "close",
                "Strict-Transport-Security": "max-age=15724800; includeSubDomains"
            }
        },
        "producer": {
            "modsecurity": "ModSecurity v3.0.8 (Linux)",
            "connector": "ModSecurity-nginx v1.0.3",
            "secrules_engine": "Enabled",
            "components": [
                "OWASP_CRS/3.3.5\""
            ]
        },
        "messages": [
            {
                "message": "Restricted File Access Attempt",
                "details": {
                    "match": "Matched \"Operator `PmFromFile' with parameter `restricted-files.data' against variable `REQUEST_FILENAME' (Value: `/details/table/urn:li:dataset:(urn:li:dataPlatform:dbt,cadet.awsdatacatalog.nomis_sensitive.profile_ (11 characters omitted)' )",
                    "reference": "o91,8v4,111t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,t:lowercase",
                    "ruleId": "930130",
                    "file": "/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf",
                    "lineNumber": "106",
                    "data": "Matched Data: .profile found within REQUEST_FILENAME: /details/table/urn:li:dataset:(urn:li:dataplatform:dbt,cadet.awsdatacatalog.nomis_sensitive.profile_types,prod)",
                    "severity": "2",
                    "ver": "OWASP_CRS/3.3.5",
                    "rev": "",
                    "tags": [
                        "github_team=data-catalogue",
                        "application-multi",
                        "language-multi",
                        "platform-multi",
                        "attack-lfi",
                        "paranoia-level/1",
                        "OWASP_CRS",
                        "capec/1000/255/153/126",
                        "PCI/6.5.4"
                    ],
                    "maturity": "0",
                    "accuracy": "0"
                }
            },
            {
                "message": "Inbound Anomaly Score Exceeded (Total Score: 5)",
                "details": {
                    "match": "Matched \"Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' )",
                    "reference": "",
                    "ruleId": "949110",
                    "file": "/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf",
                    "lineNumber": "81",
                    "data": "",
                    "severity": "2",
                    "ver": "OWASP_CRS/3.3.5",
                    "rev": "",
                    "tags": [
                        "github_team=data-catalogue",
                        "application-multi",
                        "language-multi",
                        "platform-multi",
                        "attack-generic"
                    ],
                    "maturity": "0",
                    "accuracy": "0"
                }
            }
        ]
    }
}

@mitchdawson1982
Copy link
Collaborator

mitchdawson1982 commented Oct 28, 2024 •
edited
Loading

Current PR resolves the issue, still researching if more refinements can be made.PR

@murdo-moj murdo-moj closed this as completed by moving to Done in Data Catalogue Oct 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mitchdawson1982 mitchdawson1982

Labels
bug Something isn't working
Projects
Data Catalogue
Status: Done
Milestone
No milestone
Development

No branches or pull requests
3 participants
@LavMatt @mitchdawson1982 @murdo-moj