naxsi icon indicating copy to clipboard operation
naxsi copied to clipboard

XSS False Positive `Cookie: wordpress_test_cookie=WP%20Cookie%20check`

Open h3xstream opened this issue 4 years ago • 1 comments

Hi, I'm a new NAXSI user. I have notice that the following request is blocked by NAXSI.

GET / HTTP/1.1
Host: localhost:7777
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-CA,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1


Log

2021/10/07 16:31:53 [error] 19#19: *35 NAXSI_FMT: ip=192.168.224.1&server=localhost&uri=/&vers=1.3&total_processed=35&total_blocked=30&config=block&cscore0=$XSS&score0=16&zone0=HEADERS&id0=1315&var_name0=cookie, client: 192.168.224.1, server: _, request: "GET / HTTP/1.1", host: "localhost:7777"

My configuration based on the wiki page.

location / {
	SecRulesEnabled;
	DeniedUrl "/50x.html";
	#CheckRules, determining when naxsi needs to take action
	CheckRule "$SQL >= 8" BLOCK;
	CheckRule "$RFI >= 8" BLOCK;
	CheckRule "$TRAVERSAL >= 4" BLOCK;
	CheckRule "$EVADE >= 4" BLOCK;
	CheckRule "$XSS >= 8" BLOCK;
	#naxsi logs goes there
	error_log /var/log/nginx/naxsi_error.log;

	# First attempt to serve request as file, then
	# as directory, then fall back to displaying a 404.
	try_files $uri $uri/ =404;
}

If I remove the cookie header, the page is served.

h3xstream avatar Oct 07 '21 16:10 h3xstream

just whitelist id 1315 for $HEADERS_VAR:Cookie

wargio avatar Oct 07 '21 17:10 wargio