Owasp-modsecurity-crs: OWASP Rule ID 951120 False Positive on phpinfo

[cPJasonB]

Similar to https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1024

We are seeing that a phpinfo page (PHP version 7.0.31) if placed in index.php in some instances is triggering rule 951120.

Here is the text that is matching the regex from a phpinfo page:

https://regex101.com/r/h9HEvS/1

Here is the error (sanitized of IP address and domain)

Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client $IP] ModSecurity: Access denied with code 403 (phase 4). Pattern match "(?i)(?:ORA-[0-9][0-9][0-9][0-9]|java\\\\\\\\.sql\\\\\\\\.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)" at RESPONSE_BODY. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"] [line "33"] [id "951120"] [rev "1"] [msg "Oracle SQL Information Leakage"] [data "Matched Data: Oracle Corporation </td></tr>\\\\x0a<tr><td class=\\\\x22e\\\\x22>ODBC driver for PDO </td><td class=\\\\x22v\\\\x22>Wez Furlong </td></tr>\\\\x0a<tr><td class=\\\\x22e\\\\x22>ODBC </td><td class=\\\\x22v\\\\x22>Stig Bakken, Andreas Karajannis, Frank M. Kromann, Daniel R. Kalowsky </td></tr>\\\\x0a<tr><td class=\\\\x22e\\\\x22>Opcache </td><td class=\\\\x22v\\\\x22>Andi Gutmans, Zeev Suraski, Stanislav Malyshev, Dmitry Stogov, Xinchen Hui </td></tr>\\\\x0a<tr><td class=\\\\x22e\\\\x22>OpenSSL </td><td class=\\\\x22v\\\\x22>Stig Venaas, Wez Furlong, ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.0.0"] [maturity "7"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "pla [hostname "$REDACTED"] [uri "/index.php"] [unique_id "W2oizmTxbp9DpCxo849h7AAAAFQ"]

[csanders-git]

Hmm interesting. In general i'd feel strongly about blocking phpinfo pages as they can be used to make certain vulnerabilities (like LFI) worse, however not like this... we should rectify this issue, probably by adding more information about the oracle error.

[spartantri]

@csanders-git maybe we can add a phpinfo finger print and flag this as a particular event (which is usually bad if exposed to internet) and add more details to this rule to avoid false positives as you said.

[github-actions[bot]]

This issue has been open 120 days with no activity. Remove the stale label or comment, or this will be closed in 14 days