如何防止由SignalR引起的Modsecurity假阳性?

I recently built a brand new development server in order to experiment with Modsecurity. However I am getting lots of false-positives generated by a .NET 4 application using SignalR for client-server communications.

我最近构建了一个全新的开发服务器，以体验Modsecurity。然而，我得到了许多使用SignalR进行客户端-服务器通信的。net 4应用程序生成的假阳性结果。

How can I prevent false-positives without compromizing Modsecurity's efficiency?

如何在不影响Modsecurity的效率的前提下防止误报呢?

The hits seems pretty generic so I do not want to disable the rules altogether and I would like to avoid disabling hits on /signalr/ uri which would forfeit protection on SignalR.

命中似乎是相当通用的，所以我不想完全禁用规则，我想避免禁用/signalr/ uri上的命中，这将丧失对signalr的保护。

Here is how I proceeded with my setup:

以下是我如何进行我的设置:

I installed Windows Server 2012
我安装了Windows Server 2012。
Installed IIS Role
安装IIS的作用
Installed all OS Updates
安装的所有的操作系统更新
Installed ModSecurity IIS via WebPlatformInstaller
通过WebPlatformInstaller安装ModSecurity IIS
Created website and deployed application
创建网站和部署应用程序。

Here are the three common false positives I get:

以下是我得到的三种常见的误报:

SQL Authentication bypass:

SQL验证旁路:

> [client 192.168.0.104:59945] ModSecurity: Warning. Pattern match
> "(?i:(?:in\\s*?\\(+\\s*?select)|(?:(?:n?and|x?x?or|div|like|between|and|not
> |\\|\\||\\&\\&)\\s+[\\s\\w+]+(?:regexp\\s*?\\(|sounds\\s+like\\s*?[\"'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98]|[=\\d]+x))|([\"'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98]\\s*?\\d\\s*?(?:--|#))
> ..." at ARGS:connectionData. [file "C:\/Program Files/ModSecurity
> IIS/owasp_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"]
> [line "239"] [id "981246"] [msg "Detects basic SQL authentication
> bypass attempts 3/3"] [data "Matched Data: \x22name\x22:\x22 found
> within ARGS:connectionData: [{\x22name\x22:\x22*****serverhub\x22}]"]
> [severity "CRITICAL"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"]
> [hostname "*********"] [uri
> "/signalr/start?transport=webSockets&clientProtocol=1.4&connectionToken=iIxfXzLxKm9twEhHdomj4DI95so0QmpmqeTXD4Qe0VsQoJO47CHuEIuv2z7M%2B1TYx44PK5ko18t2aoaLb4WztjR1c8g0VP8MUaGkSO9KDftOzsGektSIDl%2FI1RPMQdTd&connectionData=%5B%7B%22name%22%3A%22*****serverhub%22%7D%5D&_=1461637088340"]
> [unique_id "17798225729515683844"]

Restricted SQL characters:

限制SQL字符:

> [client 192.168.0.104:59945] ModSecurity: Warning. Pattern match
> "([\\~\\!\\@\\#\\$\\%\\^\\&\\*\\(\\)\\-\\+\\=\\{\\}\\[\\]\\|\\:\\;\"\\'\\\xc2\xb4\\\xe2\x80\x99\\\xe2\x80\x98\\`\\<\\>].*?){4,}"
> at ARGS:connectionData. [file "C:\/Program Files/ModSecurity
> IIS/owasp_crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"]
> [line "159"] [id "981173"] [rev "2"] [msg "Restricted SQL Character
> Anomaly Detection Alert - Total # of special characters exceeded"]
> [data "Matched Data: \x22 found within ARGS:connectionData:
> [{\x22name\x22:\x22*****serverhub\x22}]"] [ver "OWASP_CRS/2.2.9"]
> [maturity "9"] [accuracy "8"] [tag
> "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [hostname "*********"] [uri
> "/signalr/start?transport=webSockets&clientProtocol=1.4&connectionToken=iIxfXzLxKm9twEhHdomj4DI95so0QmpmqeTXD4Qe0VsQoJO47CHuEIuv2z7M%2B1TYx44PK5ko18t2aoaLb4WztjR1c8g0VP8MUaGkSO9KDftOzsGektSIDl%2FI1RPMQdTd&connectionData=%5B%7B%22name%22%3A%22*****serverhub%22%7D%5D&_=1461637088340"]
> [unique_id "17798225729515683844"]

Missing Accept Header:

失踪的Accept标头:

> [client 192.168.0.104:59949] ModSecurity: Warning. Operator EQ matched
> 0 at REQUEST_HEADERS. [file "C:\/Program Files/ModSecurity
> IIS/owasp_crs/base_rules/modsecurity_crs_21_protocol_anomalies.conf"]
> [line "47"] [id "960015"] [rev "1"] [msg "Request Missing an Accept
> Header"] [severity "NOTICE"] [ver "OWASP_CRS/2.2.9"] [maturity "9"]
> [accuracy "9"] [tag
> "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_ACCEPT"] [tag
> "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname
> "*********"] [uri
> "/signalr/connect?transport=webSockets&clientProtocol=1.4&connectionToken=iIxfXzLxKm9twEhHdomj4DI95so0QmpmqeTXD4Qe0VsQoJO47CHuEIuv2z7M%2B1TYx44PK5ko18t2aoaLb4WztjR1c8g0VP8MUaGkSO9KDftOzsGektSIDl%2FI1RPMQdTd&connectionData=%5B%7B%22name%22%3A%22*****serverhub%22%7D%5D&tid=6"]
> [unique_id "17726168135477755906"]

PS: I am not using any SQL technology in that particular application.

PS:我没有在那个特定的应用程序中使用任何SQL技术。

1 个解决方案

#1

For the first two I would suggest you add the following rules to ignore this ConnectionData parameter for those rules:

对于前两个规则，我建议您添加以下规则以忽略这些规则的ConnectionData参数:

 SecRuleUpdateTargetById 981246 !ARGS:'ConnectionData'
 SecRuleUpdateTargetById 981173 !ARGS:'ConnectionData'

For the last I suggest removing that rule completely. I don't find it that useful as there are some browsers (on Android from memory) that don't send that header:

最后，我建议完全废除这条规则。我不觉得它有什么用处，因为有一些浏览器(从内存到Android)不发送那个标题:

SecRuleRemoveById 960015

You might want to read this answer to understand how to tune ModSecurity: Extra sensitive Mod Security rules giving 403 forbidden error

您可能想要阅读这个答案以了解如何调优ModSecurity:额外的敏感的Mod安全规则提供403禁止错误。

#1