dune73

This is an attachment that goes with 
https://coreruleset.org/20190926/running-a-few-dozens-of-new-magic-xss-payloads-against-crs-3-2/

Multiline payloads were submitted as separate payloads for simplicity. 
We do not think this changes a thing. Single payloads would be easier to detect for CRS.

******* payload-002-001 ***********
Payload: 
payload=<a href=# name=x id=x>Click me on IE11</a>
payload=<script event="onclick(blah)<wtfbbq>{}" for=x>blah.view.alert(1)</script>

dune73

Cheatsheet: https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

Extractedover 250 payloads and sent them against CRS 3.2

****** payload-000 ********
Payload:
payload=<a id=x tabindex=1 onactivate=alert(1)></a></a>

--- Paranoia Level 1 ---

dune73

test <a href="xxx">xxx</a>

dune73

Purpose
-------

This is a CRS side project with non-blocking rules in beta quality. The idea
is to allow people to use these rules in production and to provide
feedback so we can adjust them or include them at the right paranoia
level in the real releases.

Rules in Kindergarden are meant to do no harm, but they are still beta.

dune73

xxx

dune73

diff --git a/src/operators/rx.cc b/src/operators/rx.cc
index 43f6444b..b4fc6ff4 100644
--- a/src/operators/rx.cc
+++ b/src/operators/rx.cc
@@ -1,6 +1,6 @@
 /*
  * ModSecurity, http://www.modsecurity.org/
- * Copyright (c) 2015 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+ * Copyright (c) 2015 - 2020 Trustwave Holdings, Inc. (http://www.trustwave.com/)
  *

dune73

BEFORE CRS INCLUDE:

# Defense against CVE-2021-44228 
# See https://coreruleset.org/20211213/crs-and-log4j-log4shell-cve-2021-44228/

SecRule REQUEST_LINE|ARGS|ARGS_NAMES|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS|XML:/|XML://@ "@rx (?:\${[^}]{0,4}\${|\${(?:jndi|ctx))" \
    "id:1005,\
    phase:2,\
    block,\
    t:none,t:urlDecodeUni,t:cmdline,\

dune73

#! /usr/bin/env python

import subprocess
import json
import datetime
import sys
import os

def get_issue(repository: str, number: int) -> dict:
	command = f"""gh issue view \

dune73

ServerName        localhost
ServerAdmin       root@localhost
ServerRoot        /apache
User              www-data
Group             www-data
PidFile           logs/httpd.pid

ServerTokens      Prod
UseCanonicalName  On
TraceEnable       Off

dune73

# Towards a new OWASP CRS Release Policy

With the release of CRS 4.0.0 (2024-02-14), we have also started a line of
monthly releases. CRS 4.1.0 came out on March 21, so we're getting
into the habit. But there is a lot more to this than only a monthly
release and we have not explored these topics yet. This was also
highlighted in a public issue
(FIXME: Link https://github.com/coreruleset/coreruleset/issues/3624)
and a conversation in our Slack recently (OWASP Slack, channel #coreruleset).