Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Christian Folini
CRS and Log4j / Log4Shell / CVE-2021-44228
This is an evolving blog post with infos about the role of CRS in defending against the log4j vulnerability that threatens quite all logging JAVA applications. Quick Fix CRS rule 932130 is able to detect all known exploits targetting arbitrary GET and POST parameters. However, the rule is not inspecting HTTP headers such as the User-Agent and Referer. Starting Friday we saw attacks on these headers, so 932130 is not really adequate.
Introducing the CRS Sandbox
The OWASP ModSecurity Core Rule Set project is very happy to present the CRS Sandbox. It's an API that allows you to test an attack payload against CRS without the need to install a ModSecurity box or anything.
CVE-2021-35368 - CRS Request Body Bypass (Update)
There is a severe security issue in our rule set. It has been present since the release of CRS 3.1.0 and was recently brought to our attention. Here is the official advisory that we are also publishing as CVE-2021-35368 via MITRE (as usual, MITRE will take a few days until they publish this). Offical Advisory for CVE-2021-35368 The OWASP ModSecurity Core Rule Set (CRS) is affected by a request body bypass that abuses trailing pathname information.
ModSecurity v3 affected by DoS (CVE-2020-15598)
Full Disclosure mailing list archives By Date By Thread ModSecurity v3 affected by DoS (CVE-2020-15598) From: Christian Folini <christian.folini () netnea com> Date: Mon, 14 Sep 2020 09:53:44 +0200 ModSecurity v3.0.x is affected by a Denial of Service vulnerability due to the global matching of regular expressions. The combination of a non-anchored regular expression and the ModSecurity “capture” action can be exploited via a specially crafted payload.
Running a few dozens of new magic XSS payloads against CRS 3.2
Earlier today, Gareth Heyes presented a very interesting talk with dozens of new XSS payloads at the OWASP GlobalAppSec conference in Amsterdam. The CRS developers in the audience immediately started to try out the payloads, but Gareth was so quick they lost track… But being the helpful person he is, he published the slides during the evening. Thank you. This allowed us to go to business.
How to tune your WAF installation to reduce false positives
Site administrators put in a web application firewall (WAF) to block malicious or dangerous web traffic, but at the risk of blocking some valid traffic as well. A false positive is an instance of your WAF blocking a valid request. False positives are the natural enemy of every WAF installation. Each false positive means two bad things: your WAF is working too hard, consuming compute resources in order to do something it shouldn't, and legitimate traffic is not being allowed to go through.
Decrypting SSL/TLS with cipher re-negotiation during session
From: Christian Folini Date: Wed, 24 Feb 2016 15:44:05 +0100 Hello, I am currently debugging a productive apache webserver with fairly strong ssl/tls setting. Forward secrecy which makes decrypting the traffic very difficult. Disabling forward secrecy for the server is not an option. But disabling it for certain clients is OK.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Christian
Contact Christian, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack