naxsi
naxsi copied to clipboard
XSS False Positive `Cookie: wordpress_test_cookie=WP%20Cookie%20check`
Hi, I'm a new NAXSI user. I have notice that the following request is blocked by NAXSI.
GET / HTTP/1.1
Host: localhost:7777
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-CA,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Cookie: wordpress_test_cookie=WP%20Cookie%20check
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Log
2021/10/07 16:31:53 [error] 19#19: *35 NAXSI_FMT: ip=192.168.224.1&server=localhost&uri=/&vers=1.3&total_processed=35&total_blocked=30&config=block&cscore0=$XSS&score0=16&zone0=HEADERS&id0=1315&var_name0=cookie, client: 192.168.224.1, server: _, request: "GET / HTTP/1.1", host: "localhost:7777"
My configuration based on the wiki page.
location / {
SecRulesEnabled;
DeniedUrl "/50x.html";
#CheckRules, determining when naxsi needs to take action
CheckRule "$SQL >= 8" BLOCK;
CheckRule "$RFI >= 8" BLOCK;
CheckRule "$TRAVERSAL >= 4" BLOCK;
CheckRule "$EVADE >= 4" BLOCK;
CheckRule "$XSS >= 8" BLOCK;
#naxsi logs goes there
error_log /var/log/nginx/naxsi_error.log;
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
try_files $uri $uri/ =404;
}
If I remove the cookie header, the page is served.
just whitelist id 1315 for $HEADERS_VAR:Cookie