From 855bcbce344c5472dacde7ba01276f53366dbb43 Mon Sep 17 00:00:00 2001 From: Nicolas Julian <33948000+nicolasjulian@users.noreply.github.com> Date: Tue, 27 Sep 2022 20:59:51 +0700 Subject: [PATCH] Update Version ModSecurity and Coreruleset (#9086) This is related to some new bugs that found in LiveHackingEvent 1337up0522. The latest coreruleset need *ModSecurity version 2.9.6 or 3.0.8* - https://terjanq.medium.com/waf-bypasses-via-0days-d4ef1f212ec - https://coreruleset.org/20220920/crs-version-3-3-4-and-3-2-3/ - https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/ - https://github.com/coreruleset/coreruleset/releases/tag/v3.3.4 --- images/nginx/rootfs/build.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/images/nginx/rootfs/build.sh b/images/nginx/rootfs/build.sh index f3efb3663..75d765e78 100755 --- a/images/nginx/rootfs/build.sh +++ b/images/nginx/rootfs/build.sh @@ -60,10 +60,10 @@ export DATADOG_CPP_VERSION=1.3.2 export MODSECURITY_VERSION=1.0.2 # Check for recent changes: https://github.com/SpiderLabs/ModSecurity/compare/v3.0.5...v3/master -export MODSECURITY_LIB_VERSION=v3.0.5 +export MODSECURITY_LIB_VERSION=v3.0.8 # Check for recent changes: https://github.com/coreruleset/coreruleset/compare/v3.3.2...v3.3/master -export OWASP_MODSECURITY_CRS_VERSION=v3.3.2 +export OWASP_MODSECURITY_CRS_VERSION=v3.3.4 # Check for recent changes: https://github.com/openresty/lua-nginx-module/compare/v0.10.20...master export LUA_NGX_VERSION=b721656a9127255003b696b42ccc871c7ec18d59 @@ -548,6 +548,7 @@ Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-912-DOS-PROTECTION.conf Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-913-SCANNER-DETECTION.conf Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-921-PROTOCOL-ATTACK.conf +Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-922-MULTIPART-ATTACK.conf Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-931-APPLICATION-ATTACK-RFI.conf Include /etc/nginx/owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf