ModSecurity
ModSecurity copied to clipboard
lua script can not access XML variable
Describe the bug
m.getvars("XML") return null
To Reproduce
- setup modsecurity
docker run -ti --rm -p 8083:80 -e ERRORLOG=/tmp/nginx_error.log -e MODSEC_DEBUG_LOG=/tmp/debug.log -e MODSEC_AUDIT_LOG=/tmp/audit.log -e BACKEND=http://10.56.58.13:8888 docker.io/owasp/modsecurity-crs:3.3.5-nginx-alpine-202401080101
replace BACKEND address to yours
- edit
modsecurity.conf
/etc/modsecurity.d # grep lua *
modsecurity.conf:SecRuleScript "/tmp/2.lua" "id:23333,phase:2,deny"
- create lua script
-- File operation function
function writeToFile(filepath, content)
local file, err = io.open(filepath, "a") -- "w" stands for write mode
if file == nil then
error("Couldn't open file: "..err)
else
file:write(content.."\n")
file:close()
end
end
-- Test function
function test(x)
local status, err = pcall(writeToFile, "/tmp/test.txt", x)
if not status then
print("Error: " .. err)
end
end
-- Main function
function main()
local inspect = require("inspect") -- The inspect library needs to be installed separately https://github.com/kikito/inspect.lua
local vars = inspect(m.getvars("PATH_INFO")) -- Print the PATH_INFO variable to standard error
test(vars)
test("4444")
local vars = inspect(m.getvars("XML"))
test("XML"..vars)
return nil;
end
- send http request
POST /webtools/control/SOAPService HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36
Connection: close
Content-Length: 355
Content-Type: application/xml
Accept-Encoding: gzip
<?xml version='1.0' encoding='UTF-8'?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header/>
<soapenv:Body>
<ns1:clearAllEntityCaches xmlns:ns1="http://ofbiz.apache.org/service/">
<ns1:cus-obj></ns1:cus-obj>
</ns1:clearAllEntityCaches>
</soapenv:Body>
</soapenv:Envelope>
- look up /tmp/test.log
Expected behavior
Expected behavior: /tmp/test.log has information abount XML variable
Actual behavior:
/tmp/test.log content is below
{ {
name = "PATH_INFO",
value = "/webtools/control/SOAPService"
} }
4444
And some error occur
2024/01/19 08:00:42 [alert] 1#1: worker process 90735 exited on signal 6
terminate called after throwing an instance of 'std::invalid_argument'
what(): Variable not found.
Server (please complete the following information):
- ModSecurity version (and connector): [e.g. ModSecurity v3.0.8 with nginx-connector v1.0.3]
- WebServer: nginx/1.25.3
- OS (and distro): linux