Modsecurity not check POST data even SecRequestBodyAccess on is enabled

Question

I have installed modsecurity on Nginx and as well as the owasp rules, i have check SecRequestBodyAccess to on, but when i send a request with a malicious post data, it pass ok with no problem Can anyone help me?

Answer 1

1. Modsecurity by default has parameter "SecRuleEngine" set to "DetectionOnly" and work in monitor mode. Must be set to "On".
2. Modsecurity must have enabled a rule that discovers malicious code - audit_log will tell you if the malicious post data was found. Most of CRS rules find malicious using regex expressions. More fancy attacks require special configuration or new rules, some of them would never be discovered.
3. Blocking or not later depends on the settings if your're using Anomaly Scoring mode or Self-Contained mode.

For Self-Contained (older way) it is enough to have configuration line like (for POST data = phase 2):

SecDefaultAction "phase:2,log,auditlog,deny,status=403

And that's all, if post data violates any rule - attacker gets 403.

For AnomalyScore mode (newer way, more flexible) line looks like:

SecDefaultAction "phase:2,log,auditlog,pass"

Then all rules for which anomalies were found are countend and their scores are summed up. Depends on the rule it can be "critical_anomaly_score", "error_anomaly_score", "warning_anomaly_score" and "notice_anomaly_score". By default their counts as 5,4,3,2.

If the counted score equals or is greater than "inbound_anomaly_score_threshold" (default 5) then request is blocked.

Thats why by default a one rule with critical_anomaly_score (counted as 5) can block traffic. A single rule with "error_anomaly_score" (counted as 4) is not enough to stop the request.