# ------------------------------------------------------------------------ # OWASP ModSecurity Core Rule Set ver.3.0.2 # Copyright (c) 2006-2016 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under # Apache Software License (ASL) version 2 # Please see the enclosed LICENSE file for full details. # ------------------------------------------------------------------------ # # -= Paranoia Level 0 (empty) =- (apply unconditionally) # SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:3,id:954011,nolog,pass,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS" SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:4,id:954012,nolog,pass,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS" # # -= Paranoia Level 1 (default) =- (apply only when tx.paranoia_level is sufficiently high: 1 or higher) # # IIS default location SecRule RESPONSE_BODY "[a-z]:\\\\inetpub\b" \ "phase:4,\ rev:'3',\ ver:'OWASP_CRS/3.0.0',\ maturity:'9',\ accuracy:'9',\ t:none,\ capture,\ t:lowercase,\ ctl:auditLogParts=+E,\ block,\ tag:'application-multi',\ tag:'language-multi',\ tag:'platform-iis',\ tag:'platform-windows',\ tag:'attack-disclosure',\ msg:'Disclosure of IIS install location',\ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ id:954100,\ severity:'ERROR',\ chain" SecRule &GLOBAL:alerted_970018_iisDefLoc "@eq 0" \ "setvar:global.alerted_970018_iisDefLoc,\ setvar:'tx.msg=%{rule.msg}',\ setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},\ setvar:tx.anomaly_score=+%{tx.error_anomaly_score}" SecRule RESPONSE_BODY "(?:Microsoft OLE DB Provider for SQL Server(?:<\/font>.{1,20}?error '800(?:04005|40e31)'.{1,40}?Timeout expired| \(0x80040e31\)
Timeout expired
)|

internal server error<\/h1>.*?

part of the server has crashed or it has a configuration error\.<\/h2>|cannot connect to the server: timed out)" \ "phase:4,\ rev:'3',\ ver:'OWASP_CRS/3.0.0',\ maturity:'9',\ accuracy:'9',\ t:none,\ capture,\ ctl:auditLogParts=+E,\ block,\ msg:'Application Availability Error',\ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ id:954110,\ tag:'application-multi',\ tag:'language-multi',\ tag:'platform-iis',\ tag:'platform-windows',\ tag:'attack-disclosure',\ tag:'WASCTC/WASC-13',\ tag:'OWASP_TOP_10/A6',\ tag:'PCI/6.5.6',\ severity:'ERROR',\ setvar:'tx.msg=%{rule.msg}',\ setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},\ setvar:tx.anomaly_score=+%{tx.error_anomaly_score},\ setvar:tx.%{rule.id}-AVAILABILITY/APP_NOT_AVAIL-%{matched_var_name}=%{tx.0}" # # IIS Errors leakage # SecRule RESPONSE_BODY "(?:\b(?:A(?:DODB\.Command\b.{0,100}?\b(?:Application uses a value of the wrong type for the current operation\b|error')| trappable error occurred in an external object\. The script cannot continue running\b)|Microsoft VBScript (?:compilation (?:\(0x8|error)|runtime (?:Error|\(0x8))\b|Object required: '|error '800)|Version Information:<\/b>(?: |\s)(?:Microsoft \.NET Framework|ASP\.NET) Version:|>error 'ASP\b|An Error Has Occurred|>Syntax error in string in query expression|\/[Ee]rror[Mm]essage\.aspx?\?[Ee]rror\b)" \ "phase:4,\ rev:'2',\ ver:'OWASP_CRS/3.0.0',\ maturity:'9',\ accuracy:'9',\ t:none,\ capture,\ ctl:auditLogParts=+E,\ block,\ msg:'IIS Information Leakage',\ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ id:954120,\ tag:'application-multi',\ tag:'language-multi',\ tag:'platform-iis',\ tag:'platform-windows',\ tag:'attack-disclosure',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_IIS',\ tag:'WASCTC/WASC-13',\ tag:'OWASP_TOP_10/A6',\ tag:'PCI/6.5.6',\ severity:'ERROR',\ setvar:'tx.msg=%{rule.msg}',\ setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},\ setvar:tx.anomaly_score=+%{tx.error_anomaly_score},\ setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule RESPONSE_STATUS "!^404$" \ "phase:4,\ rev:'2',\ ver:'OWASP_CRS/3.0.0',\ maturity:'9',\ accuracy:'9',\ t:none,\ capture,\ ctl:auditLogParts=+E,\ block,\ msg:'IIS Information Leakage',\ logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\ id:954130,\ tag:'application-multi',\ tag:'language-multi',\ tag:'platform-iis',\ tag:'platform-windows',\ tag:'attack-disclosure',\ tag:'OWASP_CRS/LEAKAGE/ERRORS_IIS',\ tag:'WASCTC/WASC-13',\ tag:'OWASP_TOP_10/A6',\ tag:'PCI/6.5.6',\ severity:'ERROR',\ chain" SecRule RESPONSE_BODY "\bServer Error in.{0,50}?\bApplication\b" \ "t:none,\ capture,\ setvar:'tx.msg=%{rule.msg}',\ setvar:tx.outbound_anomaly_score=+%{tx.error_anomaly_score},\ setvar:tx.anomaly_score=+%{tx.error_anomaly_score},\ setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:3,id:954013,nolog,pass,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS" SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:4,id:954014,nolog,pass,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS" # # -= Paranoia Level 2 =- (apply only when tx.paranoia_level is sufficiently high: 2 or higher) # SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:3,id:954015,nolog,pass,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS" SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:4,id:954016,nolog,pass,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS" # # -= Paranoia Level 3 =- (apply only when tx.paranoia_level is sufficiently high: 3 or higher) # SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:3,id:954017,nolog,pass,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS" SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:4,id:954018,nolog,pass,skipAfter:END-RESPONSE-954-DATA-LEAKAGES-IIS" # # -= Paranoia Level 4 =- (apply only when tx.paranoia_level is sufficiently high: 4 or higher) # # # -= Paranoia Levels Finished =- # SecMarker "END-RESPONSE-954-DATA-LEAKAGES-IIS"