{"id":8037,"date":"2021-03-13T00:32:53","date_gmt":"2021-03-12T21:32:53","guid":{"rendered":"https:\/\/kifarunix.com\/?p=8037"},"modified":"2024-03-19T19:19:50","modified_gmt":"2024-03-19T16:19:50","slug":"intercept-malicious-file-upload-with-modsecurity-and-clamav","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/intercept-malicious-file-upload-with-modsecurity-and-clamav\/","title":{"rendered":"Intercept Malicious File Upload with ModSecurity and ClamAV"},"content":{"rendered":"\n<p>In this tutorial, you will learn how to intercept malicious file upload with ModSecurity and ClamAV. <\/p>\n\n\n\n<p>ModSecurity, currently known as libModSecurity or ModSecurity version 3 is<\/p>\n\n\n\n<blockquote class=\"wp-block-quote td_pull_quote td_pull_center is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>an open source, cross-platform web application firewall (WAF) module&nbsp;developed by Trustwave\u2019s SpiderLabs.&nbsp;Known as the \u201cSwiss Army Knife\u201d of WAFs, it enables web application defenders to gain visibility into HTTP(S) traffic and provides a power rules language and API to implement advanced protections.<\/em><\/p>\n\n\n\n<p>It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.<\/p>\n<\/blockquote>\n\n\n\n<p>What Can ModSecurity Do?<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Intercepts, stores, and optionally validates uploaded files<\/li>\n\n\n\n<li>Real-time application security monitoring and access control<\/li>\n\n\n\n<li>Full HTTP traffic logging<\/li>\n\n\n\n<li>Continuous passive security assessment<\/li>\n\n\n\n<li>Web application hardening<\/li>\n\n\n\n<li>Due to its ability to parse XML and apply XPath expressions with its ability to proxy requests, it can be used as an XML web service router.<\/li>\n\n\n\n<li>HTTP Protocol Protection<\/li>\n\n\n\n<li>Real-time Blacklist Lookups<\/li>\n\n\n\n<li>HTTP Denial of Service Protections<\/li>\n\n\n\n<li>Generic Web Attack Protection<\/li>\n\n\n\n<li>Error Detection and Hiding<\/li>\n<\/ul>\n\n\n\n<p><a href=\"https:\/\/www.clamav.net\/\" target=\"_blank\" aria-label=\"ClamAV (opens in a new tab)\" rel=\"noreferrer noopener\" class=\"rank-math-link\">ClamAV<\/a> on the other hand <em>is<\/em> <em>an open source antivirus engine for detecting trojans, viruses, malware &amp; other malicious threats<\/em>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Using ModSecurity and ClamAV to Intercep Malicious File Upload<\/h2>\n\n\n\n<p>ModSecurity has the ability to understand the <code><strong>multipart\/form-data<\/strong><\/code>&nbsp;encoding which is used for file uploads. This enables ModSecurity to extract the uploaded files from the request and store on a specified file system location.<\/p>\n\n\n\n<p>Apart from the ability to extract uploaded files, ModSecurity can as well, with integration with other tools such ClamAV, validate the uploaded files.<\/p>\n\n\n\n<p>ClamAV provides scripts that can be used to scan the file to <em>detect trojans, viruses, malware &amp; other malicious threats<\/em>.<\/p>\n\n\n\n<p>Follow the links below to install ModSecurity and ClamAV;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Install and Configure ModSecurity<\/h3>\n\n\n\n<p><a aria-label=\"Install and Configure ModSecurity with Apache on Ubuntu (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-libmodsecurity-with-apache-on-ubuntu-20-04\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Install and Configure ModSecurity with Apache on Ubuntu<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/configure-libmodsecurity-with-apache-on-centos-8\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Configure LibModsecurity with Apache on CentOS<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Install and Configure ClamAV<\/h3>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/install-and-use-clamav-on-ubuntu-20-04\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Install and use ClamAV on Ubuntu<\/a><\/p>\n\n\n\n<p>You can find how to install and setup ClamAV on other Linux distros.<\/p>\n\n\n\n<p><em><strong>Note<\/strong>: We run our tests on an Ubuntu 20.04 system.<\/em><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Create ModSecurity-ClamAV File Validation Script<\/h3>\n\n\n\n<p>To enable file upload validation using ModSecurity, you need to create a perl script that uses ClamAV command line anti-virus scanner, <code><strong>clamscan<\/strong><\/code>, to extract the full path of the file being uploaded and scan for any malicious threat.<\/p>\n\n\n\n<p>In this tutorial, we will place our scanner script on the <code><strong>\/etc\/apache2\/modsecurity.d\/<\/strong><\/code> directory. This is however, not a standard location and you can place it anywhere on your system.<\/p>\n\n\n\n<p>Paste the content below to create a ClamAV scanner script, <strong><code>\/etc\/apache2\/modsecurity.d\/modsec_clamav.pl<\/code><\/strong>. You can as well choose any name for your script.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat &gt; \/etc\/apache2\/modsecurity.d\/modsec_clamav.pl &lt;&lt; 'EOL'\n#!\/usr\/bin\/perl\n   \n$CLAMSCAN = \"\/usr\/bin\/clamscan\";\n   \nif (@ARGV != 1) {\n    print \"Usage: modsec_clamav.pl &lt;filename&gt;\\n\";\n    exit;\n}\n   \nmy ($FILE) = @ARGV;\n   \n$cmd = \"$CLAMSCAN --stdout --disable-summary $FILE\";\n$input = `$cmd`;\n$input =~ m\/^(.+)\/;\n$error_message = $1;\n   \n$output = \"0 Unable to parse clamscan output\";\n   \nif ($error_message =~ m\/: Empty file\\.$\/) {\n    $output = \"1 empty file\";\n}\nelsif ($error_message =~ m\/: (.+) ERROR$\/) {\n    $output = \"0 clamscan: $1\";\n}\nelsif ($error_message =~ m\/: (.+) FOUND$\/) {\n    $output = \"0 clamscan: $1\";\n}\nelsif ($error_message =~ m\/: OK$\/) {\n    $output = \"1 clamscan: OK\";\n}\n   \nprint \"$output\\n\";\nEOL<\/code><\/pre>\n\n\n\n<p>Make the script executable;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>chmod +x \/etc\/apache2\/modsecurity.d\/modsec_clamav.pl<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Create ModSecurity Rule to Intercept File Upload<\/h3>\n\n\n\n<p>Next, you need to create a custom ModSecurity rule to intercept file upload.<\/p>\n\n\n\n<p>In our setup, we have specified the location of ModSecurity rules file in our Apache site configuration file as, <code><strong>\/etc\/apache2\/modsecurity.d\/modsec_rules.conf<\/strong><\/code>.<\/p>\n\n\n\n<p>See below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>less \/etc\/apache2\/sites-available\/wordpress.conf<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;VirtualHost *:80&gt;\n    ServerAdmin webmaster@kifarunix-demo.com\n    ServerName wp.kifarunix-demo.com\n    DocumentRoot \/var\/www\/html\/wp.kifarunix-demo.com\n        modsecurity on\n        modsecurity_rules_file \/etc\/apache2\/modsecurity.d\/modsec_rules.conf  \n    &lt;Directory \/var\/www\/html\/wp.kifarunix-demo.com&gt;\n       AllowOverride All\n    &lt;\/Directory&gt;\n\n    ErrorLog \/var\/log\/apache2\/wp.error.log\n    CustomLog \/var\/log\/apache2\/wp.access.log combined\n&lt;\/VirtualHost&gt;<\/code><\/pre>\n\n\n\n<p>Below are the contents of the ModSecurity rules file;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>less \/etc\/apache2\/modsecurity.d\/modsec_rules.conf<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Include \"\/etc\/apache2\/modsecurity.d\/modsecurity.conf\"\nInclude \"\/etc\/apache2\/modsecurity.d\/owasp-crs\/crs-setup.conf\"\nInclude \"\/etc\/apache2\/modsecurity.d\/owasp-crs\/rules\/*.conf\"<\/code><\/pre>\n\n\n\n<p>Therefore, create a custom file scannner\/validation rule for ModSecurity. ModSecurity rules are defined using the&nbsp;<strong><code>SecRule<\/code><\/strong>&nbsp;directive.<\/p>\n\n\n\n<p>The syntax of a rule is;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SecRule VARIABLES \"OPERATOR\" \"TRANSFORMATIONS,ACTIONS\"<\/code><\/pre>\n\n\n\n<p>In this setup, we name our custom rules file as <code><strong>\/etc\/apache2\/modsecurity.d\/modsec_clamav.conf<\/strong><\/code>.<\/p>\n\n\n\n<p>Below is the rule configuration;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>cat \/etc\/apache2\/modsecurity.d\/modsec_clamav.conf<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>SecRule FILES_TMPNAMES \"@inspectFile \/etc\/apache2\/modsecurity.d\/modsec_clamav.pl\" \\\n  \"id:'400001', \\\n  phase:2, \\\n  t:none, \\\n  deny, \\\n  log, \\\n  msg:'Infected File upload detected', \\\n  tag:'MALICIOUS_SOFTWARE\/VIRUS'\"<\/code><\/pre>\n\n\n\n<p>Next, include the rule in the rules file.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>echo 'Include \"\/etc\/apache2\/modsecurity.d\/modsec_clamav.conf\"' &gt;&gt; \/etc\/apache2\/modsecurity.d\/modsec_rules.conf<\/code><\/pre>\n\n\n\n<p>Your rules file now looks like;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>less \/etc\/apache2\/modsecurity.d\/modsec_rules.conf<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Include \"\/etc\/apache2\/modsecurity.d\/modsecurity.conf\"\nInclude \"\/etc\/apache2\/modsecurity.d\/owasp-crs\/crs-setup.conf\"\nInclude \"\/etc\/apache2\/modsecurity.d\/owasp-crs\/rules\/*.conf\"\nInclude \"\/etc\/apache2\/modsecurity.d\/modsec_clamav.conf\"<\/code><\/pre>\n\n\n\n<p>Check Apache configuration syntax;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apachectl configtest<\/code><\/pre>\n\n\n\n<p>If you get <strong><code>Syntax OK<\/code><\/strong>, then proceed to restart\/reload Apache;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>systemctl restart apache2<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\">Testing the Interception of Malicious File Upload with ModSecurity and ClamAV<\/h4>\n\n\n\n<p>If you have  test environment, you can <a aria-label=\"download test malicious files from Eicar (opens in a new tab)\" href=\"https:\/\/www.eicar.org\/?page_id=3950\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">download test malicious files from Eicar<\/a> and try to upload to your site.<\/p>\n\n\n\n<p>While you upload, be sure to tail both Apache error log and ModSecurity audit log files.<\/p>\n\n\n\n<p>For example, in the screenshot below, I tried to upload the <a aria-label=\"eicar_com.zip (opens in a new tab)\" href=\"https:\/\/secure.eicar.org\/eicar_com.zip\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">eicar_com.zip<\/a> on my WordPress and this is the result;<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/03\/intercept-file-uploads-modsec.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1145\" height=\"274\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/03\/intercept-file-uploads-modsec.png\" alt=\"Intercept Malicious File Upload with ModSecurity and ClamAV\" class=\"wp-image-8178\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/03\/intercept-file-uploads-modsec.png?v=1615583880 1145w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/03\/intercept-file-uploads-modsec-768x184.png?v=1615583880 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/03\/intercept-file-uploads-modsec-150x36.png?v=1615583880 150w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/03\/intercept-file-uploads-modsec-300x72.png?v=1615583880 300w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/03\/intercept-file-uploads-modsec-696x167.png?v=1615583880 696w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/03\/intercept-file-uploads-modsec-1068x256.png?v=1615583880 1068w\" sizes=\"(max-width: 1145px) 100vw, 1145px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>And the ModSecurity audit logs;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>tail -f \/var\/log\/modsec_audit.log<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>---i6mkrLhp---H--\n<strong>ModSecurity: Access denied with code 403 (phase 2). Matched \"Operator `InspectFile' with parameter `\/etc\/apache2\/modsecurity.d\/modsec_clamav.pl' against variable `FILES_TMPNAMES:' (Value: `' ) [file \"\/etc\/apache2\/modsecurity.d\/modsec_clamav.conf\"] [line \"1\"] [id \"400001\"] [rev \"\"] [msg \"Infected File upload detected\"] [data \"\"] [severity \"0\"] [ver \"\"] [maturity \"0\"] [accuracy \"0\"] [tag \"MALICIOUS_SOFTWARE\/VIRUS\"] [hostname \"wp.kifarunix-demo.com\"] [uri \"\/wp-admin\/update.php\"] [unique_id \"161558337389.815242\"] [ref \"v1369,0\"]<\/strong>\n\n---i6mkrLhp---I--\n\n---i6mkrLhp---J--\n\n---i6mkrLhp---Z--<\/code><\/pre>\n\n\n\n<p>And that is it!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Useful Links<\/h3>\n\n\n\n<p><a aria-label=\"ModSecurity v2 Manaual (opens in a new tab)\" href=\"https:\/\/github.com\/SpiderLabs\/ModSecurity\/wiki\/Reference-Manual-(v2.x)\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">ModSecurity v2 Reference Manual<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Other Related Tutorials<\/h3>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/restrict-access-to-wordpress-login-page-to-specific-ips-with-libmodsecurity\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Restrict Access to WordPress Login Page to Specific IPs with libModSecurity<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/create-kibana-visualization-dashboards-for-modsecurity-logs\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Create Kibana Visualization Dashboards for ModSecurity Logs<\/a><\/p>\n\n\n\n<p><a aria-label=\" (opens in a new tab)\" href=\"https:\/\/kifarunix.com\/process-and-visualize-modsecurity-logs-on-elk-stack\/\" target=\"_blank\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Process and Visualize ModSecurity Logs on ELK Stack<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/configure-libmodsecurity-with-apache-on-centos-8\/\" target=\"_blank\" aria-label=\" (opens in a new tab)\" rel=\"noreferrer noopener\" class=\"rank-math-link\">Configure LibModsecurity with Apache on CentOS 8<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this tutorial, you will learn how to intercept malicious file upload with ModSecurity and ClamAV. ModSecurity, currently known as libModSecurity or ModSecurity version 3<\/p>\n","protected":false},"author":1,"featured_media":8180,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[34,121,1207],"tags":[3250,169,3248,1577,3249,3251,3247,1141],"class_list":["post-8037","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-howtos","category-modsecurity","tag-block-file-uploads-modsecurity","tag-clamav","tag-clamav-intercept-files-with-modsecurity","tag-clamscan","tag-detect-virus-files-with-modsecurity-and-clamav","tag-integrate-modsecurity-with-clamav","tag-intercept-malicious-file-uploads-with-modsecurity","tag-modsecurity-3","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8037"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=8037"}],"version-history":[{"count":6,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8037\/revisions"}],"predecessor-version":[{"id":21909,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/8037\/revisions\/21909"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/8180"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=8037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=8037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=8037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}