I get the following error when I try to analyse my modsec audit log: <div class="s

Further analysis. This entry seems to be the problem: <code class="n

Problem with modsecurity 2.9.2 about modsecurity-parser HOT 4 CLOSED

csoscd commented on August 19, 2024

Problem with modsecurity 2.9.2

from modsecurity-parser.

Comments (4)

csoscd commented on August 19, 2024

I identified the part where it fails. It fails while analysing the following area:

--42d6c752-A--
[11/Apr/2019:00:55:05 +0200] XK50SRHvbKyUyHS55wE8zQAAAIM 10.10.10.10 33990 10.10.10.10 443
--42d6c752-B--
GET /components/com_jdownloads/assets/rating/js/ajaxvote.php HTTP/1.1
Host: mydomain.de
Referer: https://mydomain.de/download/category/2-presse.html
PageSpeed: off
User-Agent: Serf/1.3.9 (mod_pagespeed/1.13.35.2-0)

--42d6c752-F--
HTTP/1.1 200 OK
X-Powered-By: PHP/7.2.17
Cache-Control: must-revalidate
Expires: Wed, 10 Apr 2019 23:55:05 GMT
Vary: Accept-Encoding
Upgrade: h2,h2c
Connection: Upgrade
X-Powered-By: PleskLin
Transfer-Encoding: chunked
Content-Type: text/css; charset: UTF-8;charset=UTF-8
--42d6c752-E--

--42d6c752-H--
Message: Warning. Match of "pm AppleWebKit Android" against "REQUEST_HEADERS:User-Agent" required. [file "/etc/apache2/modsecuri$
Apache-Error: [file "apache2_util.c"] [line 273] [level 3] [client 10.10.10.10] ModSecurity: Warning. Match of "pm AppleWebKit A$
Apache-Handler: proxy:unix:///var/www/vhosts/system/mydomain/php-fpm.sock|fcgi://127.0.0.1:9000
Stopwatch: 1554936905899489 12336 (- - -)
Stopwatch2: 1554936905899489 12336; combined=7574, p1=472, p2=6823, p3=77, p4=154, p5=48, sr=83, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.2.
Server: Apache
Engine-Mode: "ENABLED"

--42d6c752-Z--

from modsecurity-parser.

csoscd commented on August 19, 2024

Further analysis. This entry seems to be the problem:

Content-Type: text/css; charset: UTF-8;charset=UTF-8

from modsecurity-parser.

molu8bits commented on August 19, 2024

Thanks for reporting. Indeed if the line has more than one semicolon it can throw an exception.

from modsecurity-parser.

molu8bits commented on August 19, 2024

Ok, corrected. It works fine with more than one colon in the line in sectionF. Added also a block try/except to handle similar unknown bugs in that part of the code.

from modsecurity-parser.

Recommend Projects