36 lines
1.7 KiB
Plaintext
36 lines
1.7 KiB
Plaintext
|
SecDefaultAction "log,deny,auditlog,phase:2,status:403"
|
||
|
|
# http://www.atomicorp.com/
|
||
|
|
# Atomicorp (Gotroot.com) ModSecurity rules
|
||
|
|
# Application Security Rules for modsec 2.x
|
||
|
|
#
|
||
|
|
# Copyright 2016 by Atomicorp, Inc., all rights reserved.
|
||
|
|
# Redistribution is strictly prohibited in any form, including whole or in part.
|
||
|
|
#
|
||
|
|
# Distribution of this work or derivative of this work in any form is
|
||
|
|
# prohibited unless prior written permission is obtained from the
|
||
|
|
# copyright holder.
|
||
|
|
#
|
||
|
|
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS
|
||
|
|
# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||
|
|
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||
|
|
# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
|
||
|
|
# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
||
|
|
# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
||
|
|
# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
||
|
|
# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
||
|
|
# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
||
|
|
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
|
||
|
|
# THE POSSIBILITY OF SUCH DAMAGE.
|
||
|
|
#
|
||
|
|
#---ASL-CONFIG-FILE---
|
||
|
|
#
|
||
|
|
|
||
|
|
#skip this for technologies that dont have HPP vulnerabilities
|
||
|
|
|
||
|
|
#count arguments
|
||
|
|
##SecRule ARGS_NAMES "\." "phase:2,id:381731,rev:'2',pass,nolog,noauditlog,setvar:'TX.paramcounter_%{MATCHED_VAR_NAME}=+1'"
|
||
|
|
|
||
|
|
##SecRule TX:/paramcounter_.*/ "@gt 1" "msg:'HTTP Parameter Pollution (%{TX.1})',chain,phase:2,id:381723,rev:21,severity:'CRITICAL',deny,log,auditlog,status:403,logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}'"
|
||
|
|
##SecRule MATCHED_VARS_NAMES "TX:paramcounter_(.*)" "capture"
|
||
|
|
|