Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix awk script parsing of ERRORLOG for key uniqueID #142

Merged
merged 1 commit into from
Sep 17, 2024

Conversation

martini-source
Copy link
Member

@martini-source martini-source commented Sep 17, 2024

Parsing for uniqueID in awk script for ERRORLOG was broken.
This lead to the resulting json being invalid and therefore unable to be parsed by indexer.
Example:
Raw output:

[Tue Sep 17 08: 05: 27.183579 2024
] [security2:error
] [pid 21:tid 50
] [client 172.23.0.1: 37142
] [client 172.23.0.1
] ModSecurity: Warning. Pattern match "(?i)\\\\b(?:(?:alter|(?:(?:cre|trunc|upd)at|renam)e|de(?:lete|sc)|(?:inser|selec)t|load)[\\\\s\\\\x0b]+(?:char|group_concat|load_file)\\\\b[\\\\s\\\\x0b]*\\\\(?|end[\\\\s\\\\x0b]*?\\\\);)|[\\\\s\\\\x0b\\\\(]load_file[\\\\s\\\\x0b]*?\\\\(|[\\"'`
][\\\\s\\\\x0b
]+regexp[^0-9A-Z_a-z
]|[\\"'0-9A- ..." at ARGS:custname. [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"
] [line "488"
] [id "942360"
] [msg "Detects concatenated basic SQL injection and SQLLFI attempts"
] [data "Matched Data: ;DROP TABLE found within ARGS:custname: ;DROP TABLE users"
] [severity "CRITICAL"
] [ver "OWASP_CRS/4.5.0"
] [tag "modsecurity"
] [tag "application-multi"
] [tag "language-multi"
] [tag "platform-multi"
] [tag "attack-sqli"
] [tag "paranoia-level/1"
] [tag "OWASP_CRS"
] [tag "capec/1000/152/248/66"
] [tag "PCI/6.5.2"
] [hostname "localhost"
] [uri "/post"
] [unique_id "Zuk4RzhZik-uyUXpxVi8aQAAAAA"
], referer: http: //localhost:8080/forms/post

Currently transforms to:

{
  "modsec-alert": {
    "description": "ModSecurity: Warning. Unconditional match in SecAction. referer: http://localhost:8080/forms/post",
    "id": 980170,
    "client": "172.23.0.1",
    "hostname": "localhost",
    "uri": "/post",
    "uniqueID": "Zuk3_s5usqh0-UBcN9cBvgAAAAA"","msg": "Anomaly Scores: (Inbound Scores: blocking=10, detection=10, per_pl=10-0-0-0, threshold=1000) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=1000) - (SQLI=10, XSS=0, RFI=0, LFI=0, RCE=0, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=10)","data": "","severity": "","tags": ["modsecurity", "reporting", "OWASP_CRS", "platform-multi", "attack-sqli", "paranoia-level/1", "OWASP_CRS", "capec/1000/152/248/66", "PCI/6.5.2"],"file": "/etc/modsecurity.d/owasp-crs/rules/RESPONSE-980-CORRELATION.conf","line": 98,"rev": "","ver": "OWASP_CRS/4.5.0","maturity": "","rule_template": "# ModSec Rule Exclusion: 980170 : Anomaly Scores: (Inbound Scores: blocking=10, detection=10, per_pl=10-0-0-0, threshold=1000) - (Outbound Scores: blocking=0, detection=0, per_pl=0-0-0-0, threshold=1000) - (SQLI=10, XSS=0, RFI=0, LFI=0, RCE=0, PHPI=0, HTTP=0, SESS=0, COMBINED_SCORE=10) (severity:  )"} }

Issue is the leftover " at the end of the uniqueID value.

@martini-source martini-source merged commit 9758e00 into master Sep 17, 2024
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants