The most common way to solve a compatibility issue between ModSecurity or one of its rule sets and an application is to disable ModSecurity. In ModSecurity 1.x this can be done in .htaccess limiting it to the current directory, but in ModSecurity 2.x there is no such mechanism. Whether global or limited to a directory, such an exception is not advisable security-wise.
A better way is to create a finer exception that would disable specific rules or signatures only for a specific URL or parameter. This section collects such exceptions.
In addition, people have contributed virtual patches. Virtual patches are rules that block specific known attacks on unpatched applications, allowing to delay of the patch.
A note of caution: the trade off between false positives, i.e. letting the application work flawlessly and false negatives, i.e. not detecting attacks, is not trivial. Some of the exceptions below may be too wide and while squashing false positives, reduce to an extent of security provides by the core rule set. We would love to hear your remarks and suggestions regarding them.
Browsers
Applications
- Complete exceptions rule set for WordPress 2.7 with ModSecurity 2.5.0 and . Additional info on the specific exceptions:
- Exception options-general.php
- Exception for spell checker (this is a TinyMCE issue, so may be relevant in many other environments)
- Wordpress Flash Uploader issue and exception for ModSecurity 1.x.
- Fix a false positive for PHPMyAdmin
- Fix a false positive for ACatalog Actinic
- A virtual patch for Mambo
- Jira uses // in URI which requires disabling 960911 (Marc Stern)
- Hudson uses // in URI which requires disabling 960911. It also accepts the unusual characters ()#\[\]{} which may require more exceptions (Marc Stern)
- NetNewsWire (Cristóbal Palmer)
- MOSS aka SharePoint (Yersinia Spiros)
- Rules for Protecting WebGoat - Since WebGoat is an application security demonstration program, the rules for it are only useful mostly for educational purposes.
Great article. Thanks for including The Theme Blog's Wordpress Flash Uploader solution ;)
James Armstrong
// thethemeblog.com
http://www.che.utah.edu/~gregorcy/?p=132 barely even talks about joomla exceptions. The gist of securing joomla is there BUT not the exception rules for Joomla but rather bugzilla. Consider modifying your content title for this anchor to talk about bugzilla mod_security exceptions.
True. The article is not valuable enough and I removed it from the list.