Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Missing Java classes #1156

Closed
wants to merge 15 commits into from
Closed

Missing Java classes #1156

Show file tree
Hide file tree
Changes from 13 commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
75e1cd2
Update .travis.yml
csanders-git Sep 20, 2017
519d67d
updating crs site location
csanders-git Nov 15, 2017
66b338a
Update date and add badges
fzipi Dec 1, 2017
9601725
Merge pull request #978 from SpiderLabs/readme-minors
lifeforms Dec 4, 2017
f11241c
Fix typo with extra bracket.
fzipi Dec 4, 2017
6a2b20c
Merge badges with v3.1/dev
fzipi Dec 4, 2017
6a42d99
Update REQUEST-920-PROTOCOL-ENFORCEMENT.conf
ihacku Dec 5, 2017
17d4317
Merge pull request #979 from ihacku/patch-1
dune73 Dec 7, 2017
a216353
Updated year.
fzipi Jan 2, 2018
76661d5
init v3.2 commit
csanders-git Jul 4, 2018
26f0be9
Merge branch 'v3.2/dev' into v3.2/dev
spartantri Jul 25, 2018
942a670
Merge pull request #2 from SpiderLabs/v3.2/dev
spartantri Jul 25, 2018
37aca20
Missing java classes
spartantri Jul 26, 2018
8945641
Conflict resolution
spartantri Jan 7, 2019
072d6da
Conflict resolution
spartantri Jan 7, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .travis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,4 +28,4 @@ branches:
- v3.0/master
- v3.1/dev
notifications:
irc: "chat.freenode.net#modsecurity"
irc: "chat.freenode.net#modsecurity"
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection r

## CRS Resources

Please see the [OWASP ModSecurity Core Rule Set page](https://modsecurity.org/crs/) to get introduced to the CRS and view resources on installation, configuration, and working with the CRS.
Please see the [OWASP ModSecurity Core Rule Set page](https://coreruleset.org/) to get introduced to the CRS and view resources on installation, configuration, and working with the CRS.

## Contributing to the CRS

Expand Down
2 changes: 1 addition & 1 deletion crs-setup.conf.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# ------------------------------------------------------------------------
# OWASP ModSecurity Core Rule Set ver.3.0.2
# OWASP ModSecurity Core Rule Set ver.3.2.0
# Copyright (c) 2006-2017 Trustwave and contributors. All rights reserved.
#
# The OWASP ModSecurity Core Rule Set is distributed under
Copy link
Contributor

@fgsch fgsch Dec 8, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 3 changes above here should be done separately.

Expand Down
6 changes: 3 additions & 3 deletions rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,7 +86,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
# Magic bytes detected and payload included possibly RCE vulnerable classess detected and process execution methods detected
# anomaly score set to critical as all conditions indicate the request try to perform RCE.
SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
"@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure)" \
"@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" \
"id:944120,\
phase:2,\
block,\
Expand Down Expand Up @@ -235,7 +235,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES
ver:'OWASP_CRS/3.1.0',\
severity:'CRITICAL',\
chain"
SecRule MATCHED_VARS "@rx (?:runtime|processbuilder|clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure)" \
SecRule MATCHED_VARS "@rx (?:runtime|processbuilder|clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" \
"t:base64Decode,t:lowercase,\
setvar:'tx.msg=%{rule.msg}',\
setvar:tx.rce_score=+%{tx.critical_anomaly_score},\
Expand All @@ -244,7 +244,7 @@ SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES

# Renamed 944340 to 944240
SecRule ARGS|ARGS_NAMES|REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|REQUEST_BODY|REQUEST_HEADERS|XML:/*|XML://@* \
"@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure)" \
"@rx (?:clonetransformer|forclosure|instantiatefactory|instantiatetransformer|invokertransformer|prototypeclonefactory|prototypeserializationfactory|whileclosure|getproperty|filewriter|xmldecoder)" \
"id:944240,\
phase:2,\
block,\
Expand Down
3 changes: 3 additions & 0 deletions rules/java-classes.data
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ java.io.CharArrayReader
java.io.DataInputStream
java.io.File
java.io.FileOutputStream
java.io.FilePermission
java.io.FileWriter
java.io.FilterInputStream
java.io.FilterOutputStream
java.io.FilterReader
Expand Down Expand Up @@ -36,3 +38,4 @@ java.lang.System
javax.script.ScriptEngineManager
org.apache.commons
org.omg.CORBA
java.beans.XMLDecoder