Fixing brute force URL @Within errors.

SpiderLabs · Jun 5, 2013 · 33612c6 · 33612c6
1 parent fcca448
commit 33612c6
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 3 deletions.
diff --git a/experimental_rules/modsecurity_crs_11_brute_force.conf b/experimental_rules/modsecurity_crs_11_brute_force.conf
@@ -1,4 +1,4 @@
-# ---------------------------------------------------------------
+#---------------------------------------------------------------
 # Core ModSecurity Rule Set ver.2.2.7
 # Copyright (C) 2006-2012 Trustwave All rights reserved.
 #
@@ -36,7 +36,8 @@ SecRule IP:BRUTE_FORCE_BLOCK "@eq 1" "phase:1,id:'981037',block,nolog,setvar:ip.
 # In these cases, we skip doing the request counts.
 #
 SecRule &TX:BRUTE_FORCE_PROTECTED_URLS "@eq 0" "phase:5,id:'981038',t:none,nolog,pass,skipAfter:END_BRUTE_FORCE_PROTECTION_CHECKS"
-SecRule REQUEST_FILENAME "!@within %{tx.brute_force_protected_urls}" "phase:5,id:'981039',t:none,nolog,pass,skipAfter:END_BRUTE_FORCE_PROTECTION_CHECKS"
+SecRule REQUEST_FILENAME ".*" "chain,phase:5,id:'981039',t:none,nolog,pass,setvar:'tx.filename=#%{request_filename}#',skipAfter:END_BRUTE_FORCE_PROTECTION_CHECKS"
+ SecRule TX:FILENAME "!@within %{tx.brute_force_protected_urls}"
 SecRule IP:BRUTE_FORCE_BLOCK "@eq 1" "phase:5,id:'981040',t:none,nolog,pass,skipAfter:END_BRUTE_FORCE_PROTECTION_CHECKS"
 
 #

diff --git a/modsecurity_crs_10_setup.conf.example b/modsecurity_crs_10_setup.conf.example
@@ -326,7 +326,7 @@ SecAction \
   "id:'900014', \
   phase:1, \
   t:none, \
-  setvar:'tx.brute_force_protected_urls=/login.jsp /partner_login.php', \
+  setvar:'tx.brute_force_protected_urls=#/login.jsp# #/partner_login.php#', \
   setvar:'tx.brute_force_burst_time_slice=60', \
   setvar:'tx.brute_force_counter_threshold=10', \
   setvar:'tx.brute_force_block_timeout=300', \