为什么带有 OWASP-CRS 的 NGINX 不能正确记录警报？

Question

I have problem with logging alerts from OWASP-CRS. For example, I make request:

https://host?exec=bin/bash

Mod security blocked this request properly, but in error logs i have just one alert:

2020/02/04 16:51:34 [error] x#x: *x [client xxxx] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `4' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "79"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver ""] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "xxxx"] [uri "/"] [unique_id "8bbf3c25ee6f151f5fc09df9f11492db"] [ref ""], client: xxxx, server: localhost, request: "GET ?exec=bin/bash HTTP/1.1", host: "host"

When I switch from Anomaly Mode to Self-Contained mode I have more detailed alert:

2020/02/04 16:52:38 [error] xxx#xxx: *xxx [client xxxx] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `PmFromFile' with parameter `unix-shell.data' against variable `ARGS:exec' (Value: `bin/bash' ) [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "496"] [id "932160"] [rev ""] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: bin/bash found within ARGS:exec: bin/bash"] [severity "2"] [ver "OWASP_CRS/3.2.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION"] [tag "WASCTC/WASC-31"] [tag "OWASP_TOP_10/A1"] [tag "PCI/6.5.2"] [hostname "xxxx"] [uri "/"] [unique_id "401e59ce6bfbc7e6b2b98bcd65bfd64e"] [ref "o0,8v20,8t:urlDecodeUni,t:cmdLine,t:normalizePath,t:lowercase"], client: xxx, server: localhost, request: "GET /?exec=bin/bash HTTP/1.1", host: "host"

Why when Anomaly Mode is selected, I have no alert like above?

nginx: 1.16.1 owasp-crs: 3.2.0 nginx-connector: 1.1.0

Answer 1

the reason is that audit logging is broken in the 1.1.0 connector for any disruptive action. A fix ( https://github.com/SpiderLabs/ModSecurity-nginx/pull/175 ) is still yet to be released.