ModSecurity with OWASP-CRS blocks ERDDAP queries containing '(' and ')' characters

Question

I have installed ModSecurity on a XUbuntu 22.04 virtual machine running ERDDAP and ncWMS dockers for data distribution.

I installed ModSecurity via apt install libapache2-mod-security2 and then I enabled it via a2enmod security2.

I then installed OWASP Core Rule Set v3.3.0.

While running ERDDAP I noticed that the queries for requesting data were blocked if containing ( or ) characters.

How can I set a rule for allowing queries with ( and ) characters?

Answer 1

OWASP CRS Dev on Duty here. The first step would be indeed to analyze the logs, looking for the rules that matched your requests. These can be found in the Error logs, searching for entries containing the ModSecurity: Warning. marker. It states that a rule has been triggered, alongside details like the rule ID and the payload that led to this match. Here is an example:

[2016-10-25 08:40:01.884172] [-:error] 127.0.0.1:42732 WA7@QX8AAQEAABC4maIAAAAV [client 127.0.0.1] …
ModSecurity: Warning. Matched phrase "/bin/bash" at ARGS:exec. …
[file "/apache/conf/crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "448"] [id "932160"] …
[rev "1"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: /bin/bash found …
within ARGS:exec: /bin/bash"] [severity "CRITICAL"] [ver "OWASP_CRS/3.1.0"] [maturity "1"] [accuracy "8"] …
[tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] …
[tag "OWASP_CRS/WEB_ATTACK/COMMAND_INJECTION"] [tag "WASCTC/WASC-31"] [tag "OWASP_TOP_10/A1"] …
[tag "PCI/6.5.2"] [hostname "localhost"] [uri "/index.html"] [unique_id "WA7@QX8AAQEAABC4maIAAAAV"]

Afterward, based on this knowledge, you can write an exclusion rule in order to tune away the unwanted match while minimizing the impact on the security posture (It is not advisable to just disable entirely the rule, but rather disabling it for specific paths or not processing only specific variables).

You can read more about writing exclusions rules and dealing with false positives here: https://coreruleset.org/docs/concepts/false_positives_tuning/

I would also suggest you the following Apache / ModSecurity series of tutorials that walk through ModSecurity and CRS installation up to handling false positives: https://www.netnea.com/cms/apache-tutorials/