Matched "Operator `Within' with parameter `HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0'' against variable `REQUEST_PROTOCOL' (Value: `HTTP/HTTP/1.1' )

[bug65536]

hi, I installed completely ModSecurity v3.0.2, when I try to visit http://127.0.0.1, I was forbiddened.

in log file, it says:

[Sun Aug 12 20:12:03.300266 2018] [:error] [pid 32207:tid 140515782620928] [client 127.0.0.1:34372] ModSecurity: Warning. Matched "Operator Within' with parameter HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0'' against variable REQUEST_PROTOCOL' (Value: HTTP/HTTP/1.1' ) [file "/etc/apache2/modsecurity.d/owasp-crs/available-rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "962"] [id "920430"] [rev "2"] [msg "HTTP protocol version is not allowed by policy"] [data "HTTP/HTTP/1.1"] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/POLICY/PROTOCOL_NOT_ALLOWED"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A6"] [tag "PCI/6.5.10"] [hostname "127.0.1.1"] [uri "/"] [unique_id "153412992389.506097"] [ref "v6,13"]

I found that the value was : HTTP/HTTP/1.1 , not HTTP/1.1.

in source code https://github.com/SpiderLabs/ModSecurity/blob/v3/master/src/transaction.cc
line 1405, line 1494, m_httpVersion was add by string "HTTP/"

maybe m_httpVersion has prefix "HTTP/" already?

in crs file : crs-setup.conf, I changed the config
SecAction
"id:900230,
phase:1,
nolog,
pass,
t:none,
setvar:'tx.allowed_http_versions=HTTP/HTTP/1.0 HTTP/HTTP/1.1 HTTP/HTTP/2 HTTP/HTTP/2.0'"

It runs well and not forbiddened any more.

is it a bug in transaction.cc?

[bug65536]

in modsec_audit.log, it was like this

---7XK3E1nx---A--
[13/Aug/2018:00:11:03 -0700] 153414426338.415445 192.168.247.1 28266 127.0.1.1 80
---7XK3E1nx---B--
GET /index.html?id=1 HTTP/HTTP/1.1
Host: 192.168.247.161
Connection: keep-alive
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36
DNT: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
If-None-Match: "2aa6-5734690843e70-gzip"
If-Modified-Since: Mon, 13 Aug 2018 00:56:33 GMT

---7XK3E1nx---D--

---7XK3E1nx---F--
HTTP/HTTP/1.1 200
Last-Modified: Mon, 13 Aug 2018 00:56:33 GMT
ETag: "2aa6-5734690843e70"
Accept-Ranges: bytes
Content-Length: 10918

the HTTP/ is redundant

[victorhora]

Hi @bug65536

Based on your logs and the issue you are describing, I believe you are using libModSecurity along with the ModSecurity-apache connector.

It is true that "HTTP/" is appended to m_httpVersion, but this is due the fact that http_version on ModSecurity-nginx connector doesn't give us back the version name in the same fashion as Apache does as request_rec:::protocol data field returning the protocol string in the form of "HTTP/1.1". (comment#150989052) possibly causing the duplicate you are experiencing.

That being said, this commit from 11/2017 should have fixed this issue for you already on Apache: owasp-modsecurity/ModSecurity-apache@0b83daf

If the issue persists, please follow up on ModSecurity-apache as I believe this would be more specific to the connector rather than ModSecurity itself. Thanks.