1

I am trying to secure my Apache2 installation on my Ubuntu 22.04 server, using OWASP rules with ModSecurity, but when I installed the v3.3.4 rules and activated modsecurity, Apache2 won't start.

Packages installed:

apache2                               2.4.52-1ubuntu4.3
apache2-bin                           2.4.52-1ubuntu4.3
apache2-data                          2.4.52-1ubuntu4.3
apache2-dev                           2.4.52-1ubuntu4.3
apache2-utils                         2.4.52-1ubuntu4.3
apachetop                             0.19.7-3
libapache2-mod-perl2                  2.0.12-1build1
libapache2-mod-php                    2:8.2+93+ubuntu22.04.1+deb.sury.org+2
libapache2-mod-php8.1                 8.1.16+repack-1+ubuntu22.04.1+deb.sury.org+1
libapache2-mod-php8.2                 8.2.3-1+ubuntu22.04.1+deb.sury.org+1
libapache2-mod-security2              2.9.5-1
libapache2-mod-wsgi                   4.6.8-1ubuntu3.1
libapache2-reload-perl                0.13-3
python3-certbot-apache                1.21.0-1
libpcre16-3:amd64                     2:8.39-13ubuntu0.22.04.1
libpcre2-16-0:amd64                   10.40-1+ubuntu22.04.1+deb.sury.org+1
libpcre2-8-0:amd64                    10.40-1+ubuntu22.04.1+deb.sury.org+1
libpcre3:amd64                        2:8.39-13ubuntu0.22.04.1
libpcre3-dev:amd64                    2:8.39-13ubuntu0.22.04.1
libpcre32-3:amd64                     2:8.39-13ubuntu0.22.04.1
libpcrecpp0v5:amd64                   2:8.39-13ubuntu0.22.04.1

Rules installed:

https://github.com/coreruleset/coreruleset/archive/refs/tags/v3.3.4.tar.gz

I got this in the apache error log:

systemd[1]: Starting The Apache HTTP Server...
apachectl[632035]: AH00526: Syntax error on line 43 of /etc/modsecurity/rules/REQUEST-922-MULTIPART-ATTACK.conf:
apachectl[632035]: Error creating rule: Unknown variable: &MULTIPART_PART_HEADERS
apachectl[632032]: Action 'start' failed.
apachectl[632032]: The Apache error log may have more information.
systemd[1]: apache2.service: Control process exited, code=exited, status=1/FAILURE
systemd[1]: apache2.service: Failed with result 'exit-code'.
Feb 17 14:33:40 belleville systemd[1]: Failed to start The Apache HTTP Server.

Here is the file and lines in question:

1 # ------------------------------------------------------------------------
  2 # OWASP ModSecurity Core Rule Set ver.3.3.4
  3 # Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
  4 # Copyright (c) 2021-2022 Core Rule Set project. All rights reserved.
  5 #
  6 # The OWASP ModSecurity Core Rule Set is distributed under
  7 # Apache Software License (ASL) version 2
  8 # Please see the enclosed LICENSE file for full details.
  9 # ------------------------------------------------------------------------
 10
 11 #
 12 # -= Paranoia Level 0 (empty) =- (apply unconditionally)
 13 #
 14
 15 # This file is to address the 3UWMWA6W vulnerability.
 16 # It requires ModSecurity version 2.9.6 or 3.0.8 (or an updated version with backports
 17 # of the security fixes in these versions) or a compatible engine supporting these changes.
 18 #
 19 # If you cannot upgrade ModSecurity, this file will cause ModSecurity to fail to start.
 20 # In that case, you can temporarily delete this file. However, you will be missing
 21 # protection from these rules. Therefore, we recommend upgrading your engine instead.
 22
 23 # The rules in this file will be part of the 920 / 921 in the future.
 24
 25 # Only allow specific charsets when using "_charset_"
 26 # Note: this is in phase:2 because these are headers that come in the body
 27 SecRule &MULTIPART_PART_HEADERS:_charset_ "!@eq 0" \
 28     "id:922100,\
 29     phase:2,\
 30     block,\
 31     t:none,\
 32     msg:'Multipart content type global _charset_ definition is not allowed by policy',\
 33     logdata:'Matched Data: %{ARGS._charset_}',\
 34     tag:'application-multi',\
 35     tag:'language-multi',\
 36     tag:'platform-multi',\
 37     tag:'attack-multipart-header',\
 38     tag:'OWASP_CRS',\
 39     tag:'capec/1000/255/153',\
 40     tag:'paranoia-level/1',\
 41     ver:'OWASP_CRS/3.3.4',\
 42     severity:'CRITICAL',\
 43     chain"
 44     SecRule ARGS:_charset_ "!@within |%{tx.allowed_request_content_type_charset}|" \
 45         "t:lowercase,\
 46         setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
 47
4
  • It's telling you exactly which line in which file is causing the error. What is the content of that line?
    – Panki
    Feb 17 at 13:58
  • Sorry forgot to include the file, I edited the question to add it, thank you.
    – Gabriel Cretin
    Feb 17 at 14:17
  • Actually I just found an issue related to this: github.com/coreruleset/coreruleset/issues/3129
    – Gabriel Cretin
    Feb 17 at 14:18
  • 1
    You should remove the part beginning with "EDIT: SOLVED" and paste it as an answer.
    – dr_
    Feb 17 at 15:07

2 Answers 2

Reset to default
1

As you can read in config file:

It requires ModSecurity version 2.9.6 or 3.0.8

And you have

libapache2-mod-security2              2.9.5-1

So you can try to upgrade this library

1
  • 1
    Thanks for your answer, I indeed edited the question after finding this by myself just after posting the question, to update the package I had to take it from another repo: modsecurity.digitalwave.hu
    – Gabriel Cretin
    Feb 17 at 15:03
1

The problem in short is that the mod security packages are outdated even in the latest Ubuntu releases (22.04 at the time).

I found a closed issue here: https://github.com/coreruleset/coreruleset/issues/3129

which suggests to use this repo https://modsecurity.digitalwave.hu/ to upgrade/install the packages libapache2-mod-security2, libmodsecurity3 and modsecurity-crs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .