directive exec in rule #1047

gassonet9 · 2024-04-24T09:43:02Z

gassonet9
Apr 24, 2024

Hello, good morning everyone, I have installed coraza+haproxy, and I am having trouble executing a script in a rule, I edit a file adding the default rule that is in the documentation with the 'exec' parameter but when I restart the service, this one falls. I thought it could be a problem with the user running coraza, who does not have permissions, but this is more than proven. It would be of great help to be able to implement this measure, thank you in advance and I await your response!

jptosso · 2024-04-24T16:39:15Z

jptosso
Apr 24, 2024
Maintainer

Hey! Can you share the logs? also cc @fionera

0 replies

fionera · 2024-04-24T16:42:49Z

fionera
Apr 24, 2024

Can you also send the configurations to reproduce this? Which versions are running for Coraza-SPOA, HAProxy etc.?

0 replies

gassonet9 · 2024-04-25T07:42:51Z

gassonet9
Apr 25, 2024
Author

Versions of Coraza and Haproxy

root@CORAZA:~$dpkg -l | grep haproxy
ii haproxy ---- 2.6.12-1+deb12u1 ------ amd64--------fast and reliable load balancing reverse proxy

-Coraza was implement in the version 3.1.0

Coraza config

coraza.conf

cat /etc/coraza-spoa/coraza.conf | grep ^[^#]

SecRuleEngine On
SecRequestBodyAccess On
SecRule REQUEST_HEADERS:Content-Type "^(?:application(?:/soap\+|/)|text/)xml" \
     "id:'200000',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRule REQUEST_HEADERS:Content-Type "^application/json" \
     "id:'200001',phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
SecRequestBodyLimit 13107200
SecRequestBodyInMemoryLimit 131072
SecRequestBodyLimitAction Reject
SecRule REQBODY_ERROR "!@eq 0" \
"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
"id:'200003',phase:2,t:none,log,deny,status:400, \
msg:'Multipart request body failed strict validation: \
PE %{REQBODY_PROCESSOR_ERROR}, \
BQ %{MULTIPART_BOUNDARY_QUOTED}, \
BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
DB %{MULTIPART_DATA_BEFORE}, \
DA %{MULTIPART_DATA_AFTER}, \
HF %{MULTIPART_HEADER_FOLDING}, \
LF %{MULTIPART_LF_LINE}, \
SM %{MULTIPART_MISSING_SEMICOLON}, \
IQ %{MULTIPART_INVALID_QUOTING}, \
IP %{MULTIPART_INVALID_PART}, \
IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
SecRule MULTIPART_UNMATCHED_BOUNDARY "@eq 1" \
    "id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"
SecRule TX:/^COR_/ "!@streq 0" \
        "id:'200005',phase:2,t:none,deny,msg:'Coraza internal error flagged: %{MATCHED_VAR_NAME}'"
SecResponseBodyAccess On
SecResponseBodyMimeType text/plain text/html text/xml
SecResponseBodyLimit 524288
SecResponseBodyLimitAction ProcessPartial
SecDataDir /tmp/
SecDebugLog /var/log/coraza-spoa/debug.log
SecDebugLogLevel 7
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:(5|4)(0|1)[0-9])$"
SecAuditLogParts ABIJDEFHZ
SecAuditLogType Serial
SecArgumentSeparator &
SecCookieFormat 0

config,yml

cat /etc/coraza-spoa/config.yaml

bind: 127.0.0.1:9000


default_application: haproxy_waf

applications:
  haproxy_waf:
 
    directives: |
      Include /etc/coraza-spoa/coraza.conf
      Include /etc/coraza-spoa/crs-setup.conf
      Include /etc/coraza-spoa/plugins/*-config.conf
      Include /etc/coraza-spoa/plugins/*-before.conf
      Include /etc/coraza-spoa/rules/*.conf
      Include /etc/coraza-spoa/plugins/*-after.conf

    no_response_check: true


    transaction_ttl_ms: 60000

    transaction_active_limit: 100000


    log_level: debug

    log_file: /var/log/coraza-spoa/coraza-agent.log

crs_setup.conf

cat crs-setup.conf | grep ^[^#]

SecDefaultAction "phase:1,log,auditlog,pass"
SecDefaultAction "phase:2,log,auditlog,pass"
SecAction \
    "id:900990,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    tag:'OWASP_CRS',\
    ver:'OWASP_CRS/4.2.0-dev',\
    setvar:tx.crs_setup_version=420"

Haproxy config

coraza.cfg

cat coraza.cfg

[coraza]
spoe-agent coraza-agent
 

    option      var-prefix      coraza
    option      set-on-error    error
    timeout     hello           2s
    timeout     idle            2m
    timeout     processing      500ms
    use-backend coraza-spoa
    log         global

spoe-message coraza-req
    args app=str(haproxy_waf) id=unique-id src-ip=src src-port=src_port dst-ip=dst dst-port=dst_port method=method path=path query=query version=req.ver headers=req.hdrs body=req.body
    event on-frontend-http-request

spoe-message coraza-res
    args app=str(haproxy_waf) id=unique-id version=res.ver status=status headers=res.hdrs body=res.body
    event on-http-response

haproxy.cfg

cat haproxy.cfg

global
    log stdout format raw local0

defaults
    log global
    option httplog
    timeout client 1m
        timeout server 1m
        timeout connect 10s
        timeout http-keep-alive 2m
        timeout queue 15s
        timeout tunnel 4h  # for websocket
backend wordpress_backend
    mode http
    balance roundrobin
    option http-server-close
    server wordpress_server 192.168.20.225:80 check
    option forwardfor

frontend test
    mode http
    bind *:80
    option tcplog
    option http-server-close
    option forwardfor
    http-request set-header X-Real-IP %[src]
    capture request header X-Forwarded-For len 25
    capture response header X-Forwarded-For len 25

    unique-id-format %[uuid()]
    unique-id-header X-Unique-ID
    filter spoe engine coraza config /etc/haproxy/coraza.cfg

    http-request redirect code 302 location %[var(txn.coraza.data)] if { var(txn.coraza.action) -m str redirect }
    http-response redirect code 302 location %[var(txn.coraza.data)] if { var(txn.coraza.action) -m str redirect }

    http-request deny deny_status 403 hdr waf-block "request"  if { var(txn.coraza.action) -m str deny }
    http-response deny deny_status 403 hdr waf-block "response" if { var(txn.coraza.action) -m str deny }

    http-request silent-drop if { var(txn.coraza.action) -m str drop }
    http-response silent-drop if { var(txn.coraza.action) -m str drop }



    use_backend wordpress_backend
    default_backend test_backend

backend test_backend
    mode http
    option forwardfor

backend coraza-spoa
    mode tcp
    balance roundrobin
    timeout connect 5s # greater than hello timeout
    timeout server 3m  # greater than idle timeout
    server s1 127.0.0.1:9000
    option forwardfor

LOG

debug.log

When I comment the rule that contains 'exec' the debug log looks like this:

2024/04/25 09:32:28 [DEBUG] Evaluating action tx_id="8e4b7a65-6d7d-4d7b-892e-a13e54cb39f9" action="nolog"
2024/04/25 09:32:28 [DEBUG] Evaluating operator: MATCH tx_id="8e4b7a65-6d7d-4d7b-892e-a13e54cb39f9" rule_id=980014 operator_function="@lt" operator_data="2" arg="1"
2024/04/25 09:32:28 [DEBUG] Executing disruptive action for rule tx_id="8e4b7a65-6d7d-4d7b-892e-a13e54cb39f9" rule_id=980014 action="pass"
2024/04/25 09:32:28 [DEBUG] Evaluating flow action for rule tx_id="8e4b7a65-6d7d-4d7b-892e-a13e54cb39f9" rule_id=980014 action="skipafter" phase=2
2024/04/25 09:32:28 [DEBUG] Starting secmarker tx_id="8e4b7a65-6d7d-4d7b-892e-a13e54cb39f9" value="END-RESPONSE-980-CORRELATION"
2024/04/25 09:32:28 [DEBUG] Rule matched tx_id="8e4b7a65-6d7d-4d7b-892e-a13e54cb39f9" rule_id=980014
2024/04/25 09:32:28 [DEBUG] Finish evaluating rule tx_id="8e4b7a65-6d7d-4d7b-892e-a13e54cb39f9" rule_id=980014
2024/04/25 09:32:28 [DEBUG] Skipping rule because of SkipAfter tx_id="8e4b7a65-6d7d-4d7b-892e-a13e54cb39f9" rule_id=980016 skip_after="END-RESPONSE-980-CORRELATION" secmarker=""
2024/04/25 09:32:28 [DEBUG] Skipping rule because of SkipAfter tx_id="8e4b7a65-6d7d-4d7b-892e-a13e54cb39f9" rule_id=980018 skip_after="END-RESPONSE-980-CORRELATION" secmarker=""
2024/04/25 09:32:28 [DEBUG] Finished phase tx_id="8e4b7a65-6d7d-4d7b-892e-a13e54cb39f9" phase=2

Now i write rule with exec:

2024/04/25 09:35:52 [DEBUG] Parsing directive line="SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 3\" \"id:980016,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.2.0-dev',skipAfter:END-RESPONSE-980-CORRELATION\""
2024/04/25 09:35:52 [DEBUG] Parsing directive line="SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:980017,phase:1,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.2.0-dev',skipAfter:END-RESPONSE-980-CORRELATION\""
2024/04/25 09:35:52 [DEBUG] Parsing directive line="SecRule TX:DETECTION_PARANOIA_LEVEL \"@lt 4\" \"id:980018,phase:2,pass,nolog,tag:'OWASP_CRS',ver:'OWASP_CRS/4.2.0-dev',skipAfter:END-RESPONSE-980-CORRELATION\""
2024/04/25 09:35:52 [DEBUG] Parsing directive line="SecMarker \"END-RESPONSE-980-CORRELATION\""
2024/04/25 09:35:52 [DEBUG] Added secmark rule
2024/04/25 09:35:52 [DEBUG] Parsing directive line="SecRule ARGS:p attack \"phase:2,id:113,block,exec:/etc/coraza-spoa/script/test.lua\""

log detection

{"level":"error","ts":1714030546.2511408,"msg":"unable to create waf instance","app":"haproxy_waf","error":"invalid WAF config from string: failed to parse string: failed to compile the directive \"secrule\": invalid operator for rule with operator: \"ARGS:p attack \\\"phase:2,id:113,block,exec:/etc/coraza-spoa/script/test.lua\\\"\""}
{"level":"error","ts":1714030547.6919732,"msg":"unable to create waf instance","app":"haproxy_waf","error":"invalid WAF config from string: failed to parse string: failed to compile the directive \"secrule\": invalid operator for rule with operator: \"ARGS:p attack \\\"phase:2,id:113,block,exec:/etc/coraza-spoa/script/test.lua\\\"\""}
{"level":"error","ts":1714030549.1776783,"msg":"unable to create waf instance","app":"haproxy_waf","error":"invalid WAF config from string: failed to parse string: failed to compile the directive \"secrule\": invalid operator for rule with operator: \"ARGS:p attack \\\"phase:2,id:113,block,exec:/etc/coraza-spoa/script/test.lua\\\"\""}
{"level":"error","ts":1714030550.714065,"msg":"unable to create waf instance","app":"haproxy_waf","error":"invalid WAF config from string: failed to parse string: failed to compile the directive \"secrule\": invalid operator for rule with operator: \"ARGS:p attack \\\"phase:2,id:113,block,exec:/etc/coraza-spoa/script/test.lua\\\"\""}
{"level":"error","ts":1714030552.1861174,"msg":"unable to create waf instance","app":"haproxy_waf","error":"invalid WAF config from string: failed to parse string: failed to compile the directive \"secrule\": invalid operator for rule with operator: \"ARGS:p attack `\\\"phase:2,id:113,block,exec:/etc/coraza-spoa/script/test.lua\\\"\""}`

The rules with exec :

cat /etc/coraza-spoa/rules/script.conf

SecRule REQUEST_URI "^/cgi-bin/script\.pl" "phase:2,id:112,t:none,t:lowercase,t:normalizePath,block,\ exec:/etc/coraza-spoa/script/test.sh"


SecRule ARGS:p attack "phase:2,id:113,block,exec:/etc/coraza-spoa/script/test.lua"

6 replies

fionera Apr 25, 2024

Please put the configs into markdown code areas. These are just ``` at the beginning and the end

gassonet9 Apr 26, 2024
Author

You can check now @fionera. Thank you in advance for your support!!

fionera Apr 29, 2024

I will check the next days, currently too much things at work sadly :/

fionera May 4, 2024

To be honest this looks like the config is just invalid. I myself are not an expert regarding secrules so this would be something that @jptosso would have to look at. The haproxy and coraza-spop config seems fine

gassonet9 May 7, 2024
Author

okey thanks, now i try to implement fail2ban to block, thaks another time! @fionera

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

directive exec in rule #1047

{{title}}

Replies: 3 comments 6 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

directive exec in rule #1047

gassonet9 Apr 24, 2024

Replies: 3 comments · 6 replies

jptosso Apr 24, 2024 Maintainer

fionera Apr 24, 2024

gassonet9 Apr 25, 2024 Author

Versions of Coraza and Haproxy

Coraza config

coraza.conf

config,yml

crs_setup.conf

Haproxy config

coraza.cfg

haproxy.cfg

LOG

debug.log

log detection

The rules with exec :

fionera Apr 25, 2024

gassonet9 Apr 26, 2024 Author

fionera Apr 29, 2024

fionera May 4, 2024

gassonet9 May 7, 2024 Author

gassonet9
Apr 24, 2024

Replies: 3 comments 6 replies

jptosso
Apr 24, 2024
Maintainer

fionera
Apr 24, 2024

gassonet9
Apr 25, 2024
Author

gassonet9 Apr 26, 2024
Author

gassonet9 May 7, 2024
Author