Hat jemand Probleme mit der WAF seit dem Update auf 9.2 ? Wir haben das Problem das OWA und andere Portale nach dem Update nicht mehr funktinieren [:@]
Im Log finde ich einige Meldungen mit SQL-Injections (unabhängig auf 3 verschiedenen UTM's)
reverseproxy: [Mon May 26 09:23:45.803821 2014] [security2:error] [pid 8130:tid 3946158960] [client x.x.x.x] ModSecurity: Warning. Pattern match "(^[\"'`\xc2\xb4\xe2\x80\x99\xe2\x80\x98;]+|[\"'
`\xc2\xb4\xe2\x80\x99\xe2\x80\x98;]+$)" at REQUEST_COOKIES:cadata. [file "/usr/apache/conf/waf/modsecurity_crs_sql_injection_attacks.conf"] [line "64"] [id "981318"] [rev "2"] [msg "SQL Injection Attack: Common Injection Testing
Detected"] [data "Matched Data: \x22 found within REQUEST_COOKIES:cadata: \x220M2kAvdS8Mar8s7/xxB831hG6Yq6ZPW83GfL7tNqnPGJtICe k46n8ww1xvgm/dB7g24eqQ==\x22"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.7"] [maturity "9"] [accuracy "8"]
[tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "owa.rjd.de"] [uri "/owa/"] [unique_id "U4LsAcCojAEAAB-CodAAAABW"]
2014:05:26-09:23:45 sophos-2 reverseproxy: [Mon May 26 09:23:45.806064 2014] [security2:error] [pid 8130:tid 3946158960] [client x.x.x.x] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(.*)" at TX:981318-OWASP_CR
S/WEB_ATTACK/SQL_INJECTION-REQUEST_COOKIES:cadata. [file "/usr/apache/conf/waf/modsecurity_crs_inbound_blocking.conf"] [line "26"] [id "981176"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5, SQLi=5, XSS=): Last Matched Message: S
QL Injection Attack: Common Injection Testing Detected"] [data "Last Matched Data: \x22"] [hostname "owa.rjd.de"] [uri "/owa/"] [unique_id "U4LsAcCojAEAAB-CodAAAABW"]
2014:05:26-09:23:45 sophos-2 reverseproxy: [Mon May 26 09:23:45.806233 2014] [security2:error] [pid 8130:tid 3946158960] [client x.x.x.x] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/usr/apache/co
nf/waf/modsecurity_crs_correlation.conf"] [line "37"] [id "981204"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5, SQLi=5, XSS=): SQL Injection Attack: Common Injection Testing Detected"] [hostname "owa.rjd.de"] [uri "/o
wa/"] [unique_id "U4LsAcCojAEAAB-CodAAAABW"]
Die ID's habe ich schon geskippt, bringt nischt
This thread was automatically locked due to age.
