{"action":"closed","number":255,"pull_request":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/pulls/255","id":45540808,"html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/255","diff_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/255.diff","patch_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/255.patch","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/255","number":255,"state":"closed","locked":false,"title":"Adding new request smuggling / header injection rules to REQUEST-21-P…","user":{"login":"dune73","id":618722,"avatar_url":"https://avatars.githubusercontent.com/u/618722?v=3","gravatar_id":"","url":"https://api.github.com/users/dune73","html_url":"https://github.com/dune73","followers_url":"https://api.github.com/users/dune73/followers","following_url":"https://api.github.com/users/dune73/following{/other_user}","gists_url":"https://api.github.com/users/dune73/gists{/gist_id}","starred_url":"https://api.github.com/users/dune73/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dune73/subscriptions","organizations_url":"https://api.github.com/users/dune73/orgs","repos_url":"https://api.github.com/users/dune73/repos","events_url":"https://api.github.com/users/dune73/events{/privacy}","received_events_url":"https://api.github.com/users/dune73/received_events","type":"User","site_admin":false},"body":"### 950915:\tDetecting Carriage Returns in any sort of parameters\r\nfollowed by suspicious HTTP method names.\r\n\r\nLike the previous rules, this is legitimate, but\r\nstill suspiscious.\r\n\r\nFalse positives rate:\r\nBased on 156 M requests from approximately 90 services,\r\nwe did not receive any positives at all.\r\n\r\nExample call triggering the rule:\r\n$> curl -v -d \"data=\r\nGET /foo\" 'http://www.example.com/index.html'\r\n\r\n\r\nProposed Severity: Critical (-> 5 points)\r\n\r\n\r\n\r\n### 950912: Detecting Carriage Returns in Request Header names and Request Headers.\r\nThis rule assumes there is no point in having a CR or LF in any\r\nhttp header names (obviously), but also http header values.\r\n\r\nFalse positives rate:\r\nBased on 156 M requests from approximately 90 services,\r\nwe received 18K positives. That means 0.0117% Requests \r\ntriggered positives.\r\n\r\nWhen investigating the positives, over 90% relate to cookies.\r\n\r\nExample call triggering the rule: \r\n$> curl -v -H \"Cookie: footer=Cheers,%0A%0DSam\" 'http://www.example.com/index.html'\r\n\r\nProposed Severity: Critical (-> 5 points)\r\n\r\n\r\n\r\n### 950913: Detecting Carriage Returns in argument names and in query strings.\r\n\r\nAgain, it is easy to see, that CRs and LFs have no place in these\r\nspots.\r\n\r\nFalse positives rate:\r\nBased on 156 M requests from approximately 90 services,\r\nwe received 17K positives. That means 0.0108% requests \r\ntriggered positives.\r\n\r\nWhen investing the positives, 90% of the positives boil\r\ndown to an extensive filter string issued in a strange search\r\nlanguage. Another 5% relate to a query string send within\r\none service and the query string contained a mail\r\naddress with CRs.\r\n\r\nExample call triggering the rule: \r\n$> curl -v -d \"da\r\nta=foo\" http://www.example.com/index.html\r\n\r\nProposed Severity: Critical (-> 5 points)\r\n\r\n\r\n\r\n### 950914:\tDetecting Carriage Returns in any sort of parameter values\r\nfollowed by suspicious HTTP Request header names.\r\n\r\nThis includes Request Body and naturally this is where we\r\nhave to expect false positives even with benign applications.\r\nStill, to bring a CR / LF and then start the new Line with\r\n\"Refresh\" is suspicious and bears for further investigation.\r\n\r\nFalse positives rate:\r\nBased on 156 M requests from approximately 90 services,\r\nwe received 150 positives. That means 0.0009% requests\r\ntriggered positives.\r\n\r\nExample call triggering the rule: \r\n$> curl -v -d \"data=\r\nlocation: foo\" 'http://www.example.com/index.html'\r\n\r\nProposed Severity: Critical (-> 5 points)\r\n\r\nOne could settle on Error here too, but false positives are\r\nactually quite rare, so I do not think it is worth to go\r\nfor 4 points, as hardly anything in the core rules gives\r\n4 points, there clearly is a 5 points habit. So this is\r\nwhat I suggest.\r\n\r\n\r\nAnd finally the isolated CR / LF in the request body:\r\n\r\n### 950916:\tDetecing Carriage Returns in the request body\r\n\r\nThis is frequently encountered and only mildly \r\nsuspicious. Still, in most applications, most\r\nhttp request parameters will be free from CRs / LFs\r\nand the latter characters will only be found in\r\ncertain fields. So this might at least be an\r\noptional rule useful for the most paranoid of\r\nall administrators interesting in the tuning\r\ninvolved with this rule.\r\n\r\nFalse positives rate:\r\nBased on 156 M requests from approximately 90 services,\r\nwe received 1.89 M positives. That means 1.213% requests\r\ntriggered positives.\r\n\r\nExample call triggering the rule:\r\n$> curl -v -d \"data=\r\nabc\" 'http://www.example.com/index.html'\r\n\r\nProposed Severity: Notice (-> 2 points)\r\n","created_at":"2015-09-21T12:07:45Z","updated_at":"2015-09-22T20:17:50Z","closed_at":"2015-09-22T20:17:50Z","merged_at":"2015-09-22T20:17:50Z","merge_commit_sha":"a598e28014da356d3c347bfd077431a449f3c6d8","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/pulls/255/commits","review_comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/pulls/255/comments","review_comment_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/pulls/comments{/number}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/255/comments","statuses_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/statuses/0734e9cf94ca6f5f19f28e7f23798658faf8ffd0","head":{"label":"dune73:v3.0.0-dev","ref":"v3.0.0-dev","sha":"0734e9cf94ca6f5f19f28e7f23798658faf8ffd0","user":{"login":"dune73","id":618722,"avatar_url":"https://avatars.githubusercontent.com/u/618722?v=3","gravatar_id":"","url":"https://api.github.com/users/dune73","html_url":"https://github.com/dune73","followers_url":"https://api.github.com/users/dune73/followers","following_url":"https://api.github.com/users/dune73/following{/other_user}","gists_url":"https://api.github.com/users/dune73/gists{/gist_id}","starred_url":"https://api.github.com/users/dune73/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dune73/subscriptions","organizations_url":"https://api.github.com/users/dune73/orgs","repos_url":"https://api.github.com/users/dune73/repos","events_url":"https://api.github.com/users/dune73/events{/privacy}","received_events_url":"https://api.github.com/users/dune73/received_events","type":"User","site_admin":false},"repo":{"id":9910383,"name":"owasp-modsecurity-crs","full_name":"dune73/owasp-modsecurity-crs","owner":{"login":"dune73","id":618722,"avatar_url":"https://avatars.githubusercontent.com/u/618722?v=3","gravatar_id":"","url":"https://api.github.com/users/dune73","html_url":"https://github.com/dune73","followers_url":"https://api.github.com/users/dune73/followers","following_url":"https://api.github.com/users/dune73/following{/other_user}","gists_url":"https://api.github.com/users/dune73/gists{/gist_id}","starred_url":"https://api.github.com/users/dune73/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dune73/subscriptions","organizations_url":"https://api.github.com/users/dune73/orgs","repos_url":"https://api.github.com/users/dune73/repos","events_url":"https://api.github.com/users/dune73/events{/privacy}","received_events_url":"https://api.github.com/users/dune73/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/dune73/owasp-modsecurity-crs","description":"OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)","fork":true,"url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs","forks_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/forks","keys_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/teams","hooks_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/hooks","issue_events_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/issues/events{/number}","events_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/events","assignees_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/assignees{/user}","branches_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/branches{/branch}","tags_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/tags","blobs_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/git/refs{/sha}","trees_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/statuses/{sha}","languages_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/languages","stargazers_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/stargazers","contributors_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/contributors","subscribers_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/subscribers","subscription_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/subscription","commits_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/commits{/sha}","git_commits_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/git/commits{/sha}","comments_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/comments{/number}","issue_comment_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/issues/comments{/number}","contents_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/contents/{+path}","compare_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/merges","archive_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/downloads","issues_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/issues{/number}","pulls_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/pulls{/number}","milestones_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/milestones{/number}","notifications_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/labels{/name}","releases_url":"https://api.github.com/repos/dune73/owasp-modsecurity-crs/releases{/id}","created_at":"2013-05-07T11:31:49Z","updated_at":"2013-09-30T14:29:55Z","pushed_at":"2015-09-21T11:59:05Z","git_url":"git://github.com/dune73/owasp-modsecurity-crs.git","ssh_url":"git@github.com:dune73/owasp-modsecurity-crs.git","clone_url":"https://github.com/dune73/owasp-modsecurity-crs.git","svn_url":"https://github.com/dune73/owasp-modsecurity-crs","homepage":"https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project","size":480,"stargazers_count":0,"watchers_count":0,"language":"Lua","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"SpiderLabs:v3.0.0-dev","ref":"v3.0.0-dev","sha":"6335689d06abac34e74efebf166ef26622cf431e","user":{"login":"SpiderLabs","id":508521,"avatar_url":"https://avatars.githubusercontent.com/u/508521?v=3","gravatar_id":"","url":"https://api.github.com/users/SpiderLabs","html_url":"https://github.com/SpiderLabs","followers_url":"https://api.github.com/users/SpiderLabs/followers","following_url":"https://api.github.com/users/SpiderLabs/following{/other_user}","gists_url":"https://api.github.com/users/SpiderLabs/gists{/gist_id}","starred_url":"https://api.github.com/users/SpiderLabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SpiderLabs/subscriptions","organizations_url":"https://api.github.com/users/SpiderLabs/orgs","repos_url":"https://api.github.com/users/SpiderLabs/repos","events_url":"https://api.github.com/users/SpiderLabs/events{/privacy}","received_events_url":"https://api.github.com/users/SpiderLabs/received_events","type":"Organization","site_admin":false},"repo":{"id":5274077,"name":"owasp-modsecurity-crs","full_name":"SpiderLabs/owasp-modsecurity-crs","owner":{"login":"SpiderLabs","id":508521,"avatar_url":"https://avatars.githubusercontent.com/u/508521?v=3","gravatar_id":"","url":"https://api.github.com/users/SpiderLabs","html_url":"https://github.com/SpiderLabs","followers_url":"https://api.github.com/users/SpiderLabs/followers","following_url":"https://api.github.com/users/SpiderLabs/following{/other_user}","gists_url":"https://api.github.com/users/SpiderLabs/gists{/gist_id}","starred_url":"https://api.github.com/users/SpiderLabs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SpiderLabs/subscriptions","organizations_url":"https://api.github.com/users/SpiderLabs/orgs","repos_url":"https://api.github.com/users/SpiderLabs/repos","events_url":"https://api.github.com/users/SpiderLabs/events{/privacy}","received_events_url":"https://api.github.com/users/SpiderLabs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs","description":"OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)","fork":false,"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","forks_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/forks","keys_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/keys{/key_id}","collaborators_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/teams","hooks_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/hooks","issue_events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/events{/number}","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/events","assignees_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/assignees{/user}","branches_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/branches{/branch}","tags_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/tags","blobs_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/git/refs{/sha}","trees_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/git/trees{/sha}","statuses_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/statuses/{sha}","languages_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/languages","stargazers_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/stargazers","contributors_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/contributors","subscribers_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/subscribers","subscription_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/subscription","commits_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/commits{/sha}","git_commits_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/git/commits{/sha}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/comments{/number}","issue_comment_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments{/number}","contents_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/contents/{+path}","compare_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/compare/{base}...{head}","merges_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/merges","archive_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/downloads","issues_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues{/number}","pulls_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/pulls{/number}","milestones_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/milestones{/number}","notifications_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/labels{/name}","releases_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/releases{/id}","created_at":"2012-08-02T15:12:08Z","updated_at":"2015-09-22T08:02:22Z","pushed_at":"2015-09-22T20:17:50Z","git_url":"git://github.com/SpiderLabs/owasp-modsecurity-crs.git","ssh_url":"git@github.com:SpiderLabs/owasp-modsecurity-crs.git","clone_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs.git","svn_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs","homepage":"https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project","size":12476,"stargazers_count":459,"watchers_count":459,"language":"Lua","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":165,"mirror_url":null,"open_issues_count":56,"forks":165,"open_issues":56,"watchers":459,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/pulls/255"},"html":{"href":"https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/255"},"issue":{"href":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/255"},"comments":{"href":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/255/comments"},"review_comments":{"href":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/pulls/255/comments"},"review_comment":{"href":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/pulls/255/commits"},"statuses":{"href":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/statuses/0734e9cf94ca6f5f19f28e7f23798658faf8ffd0"}},"merged":true,"mergeable":null,"mergeable_state":"unknown","merged_by":{"login":"csanders-git","id":4632287,"avatar_url":"https://avatars.githubusercontent.com/u/4632287?v=3","gravatar_id":"","url":"https://api.github.com/users/csanders-git","html_url":"https://github.com/csanders-git","followers_url":"https://api.github.com/users/csanders-git/followers","following_url":"https://api.github.com/users/csanders-git/following{/other_user}","gists_url":"https://api.github.com/users/csanders-git/gists{/gist_id}","starred_url":"https://api.github.com/users/csanders-git/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/csanders-git/subscriptions","organizations_url":"https://api.github.com/users/csanders-git/orgs","repos_url":"https://api.github.com/users/csanders-git/repos","events_url":"https://api.github.com/users/csanders-git/events{/privacy}","received_events_url":"https://api.github.com/users/csanders-git/received_events","type":"User","site_admin":false},"comments":3,"review_comments":0,"commits":1,"additions":144,"deletions":0,"changed_files":1}}