Web Application Defender's Cookbook

Recipe 5-5: Identifying Encoding Anomalies

This recipe demonstrates methods to validate URL encoding usage.

Ingredients

• OWASP AppSensor6
  • Unexpected Encoding Used
• ModSecurity
  • @validateUrlEncoding operator

RFC 2396, “Uniform Resource Identifiers (URI): Generic Syntax,” explains the format to be used for hex encoding of URI data:

2.4.1. Escaped Encoding
 
   An escaped octet is encoded as a character triplet, consisting of
   the percent character "%" followed by the two hexadecimal digits
   representing the octet code. For example, "%20" is the escaped
   encoding for the US-ASCII space character.
 
      escaped     = "%" hex hex
      hex         = digit | "A" | "B" | "C" | "D" | "E" | "F" |
                            "a" | "b" | "c" | "d" | "e" | "f"

To validate hex-encoded payloads in requests, you can use the following OWASP ModSecurity Core Rule Set rules from the modsecurity_crs_20_protocol_violations.conf file:

#
# Check URL encodings
#
# -=[ Rule Logic ]=-
# There are two different chained rules.  We need to separate them 
# as we are inspecting two different variables - REQUEST_URI and 
# REQUEST_BODY.
#
# For REQUEST_BODY, we only want to run the @validateUrlEncoding 
# operator if the content-type is application/x-www-form-
# urlencoding.
#
# -=[ References ]=-
# http://www.ietf.org/rfc/rfc1738.txt#
SecRule REQUEST_URI "\%((?!$|\W)|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" \
        "chain,phase:2,rev:'2.2.3',t:none,block,msg:'URL Encoding 
Abuse Attack Attempt',id:'950107',tag:'PROTOCOL_VIOLATION/EVASION',
severity:'5'"
        SecRule REQUEST_URI "@validateUrlEncoding" ...