rsub capturing group

[ekoome]

When I capture a group using rsub, I'm unable to access the capture using $1 or \1. For example
@rsub s/(test)/$1/

prints $1

Am I missing something?

[John-D-B]

Is there a resolution here? This seems like a major flaw in the system, if parameter replacement is not supported. A potential work-around is using Apache mod_substitute for straightforward replacements without ModSecurity context processing.

It's a shame that questions like this go unanswered for months or years. The first example I found, from 2011, doesn't even consider replacement patterns. https://www.trustwave.com/Resources/SpiderLabs-Blog/ModSecurity-Advanced-Topic-of-the-Week--Malware-Link-Removal/

I'm also surprised that a feature so useful (virtual-patching the response body with ModSecurity) seems so obscure and underutilized. Eg, for data leakage. Am I missing something?

[John-D-B]

Here's a work-around using ModSecurity 2.9.0 and (FYI) OWASP CRS 1120664. In this example, replace the Apache Cocoon version:

• Apache Cocoon 2.1.12

with an arbitrary string:

• Apache Cocoon myVersion

SecRule STREAM_OUTPUT_BODY \
        "@rx (Apache Cocoon\s+)([\d\.]+)" \
        "id:'1258', \
         capture, \
         chain, \
         log, \
         msg:'rsub Apache Cocoon version', \
         pass, \
         phase:4, \
         setvar:tx.versionStr=myVersion, \
         t:none, \
        "
        SecRule STREAM_OUTPUT_BODY \
                "@rsub s/%{tx.1}%{tx.2}/%{tx.1}%{tx.versionStr}/i"  \
                "log, \
                "

I'm interested to know the performance impact of doing this, especially as compared with Apache mod_substitute. I don't mind the extra RAM requirements, that's cheap and easy these days, but CPU cycles and software inefficiencies are still a cause for concern.

[meigea]

@John-D-B @victorhora
Do you have the outdated rules based on modseucurity origin by Trustware, and i want to know and get more rules to start and use ; can you give me some , i wish you all the best and hope.