mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-08 19:06:06 +03:00
Using Bookstack with ModSecurity CRS WAF #5171
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @WiredWonder on GitHub (Feb 5, 2025).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
Hi guys,
I am running BookStack behind a ModSec CRS WAF. I have found that just writing a simple page triggers lots of rules making it unusable.
I have via trial and error identified the following rules that need to be disabled to allow BookStack to function.
SecRule SERVER_NAME "xyz" \ "id:'xyz', \ phase:1, \ t:none, \ setvar:'tx.allowed_methods=GET HEAD POST OPTIONS PROPFIND PROPPATCH REPORT PUT MKCOL', \ nolog, \ pass, \ ctl:ruleRemoveById=921110, \ ctl:ruleRemoveById=932100, \ ctl:ruleRemoveById=932105, \ ctl:ruleRemoveById=932115, \ ctl:ruleRemoveById=932140, \ ctl:ruleRemoveById=932200, \ ctl:ruleRemoveById=941100, \ ctl:ruleRemoveById=941130, \ ctl:ruleRemoveById=941140, \ ctl:ruleRemoveById=941150, \ ctl:ruleRemoveById=941160, \ ctl:ruleRemoveById=941170, \ ctl:ruleRemoveById=941180, \ ctl:ruleRemoveById=941200, \ ctl:ruleRemoveById=941320, \ ctl:ruleRemoveById=941330, \ ctl:ruleRemoveById=941340, \ ctl:ruleRemoveById=942130, \ ctl:ruleRemoveById=942190, \ ctl:ruleRemoveById=942200, \ ctl:ruleRemoveById=942210, \ ctl:ruleRemoveById=942300, \ ctl:ruleRemoveById=942330, \ ctl:ruleRemoveById=942340, \ ctl:ruleRemoveById=942350, \ ctl:ruleRemoveById=942380, \ ctl:ruleRemoveById=942430, \ ctl:ruleRemoveById=942440, \ ctl:ruleRemoveById=942480, \ ctl:ruleRemoveById=942260, \ ctl:ruleRemoveById=942370"Does anyone have any other guidance on rulesets that allow BookStack to work behind a WAF?
Thanks.
Exact BookStack Version
v24.12.1
Log Content
No response
Hosting Environment
PHP 7.4 on Debian
@ssddanbrown commented on GitHub (Feb 5, 2025):
No guidance to hand, I think it'll really depend on the WAF in use.
Most issues I see (generally for apache mod security) are triggered by saving a page which contains a code block with a bunch of SQL commands in it. You could also try searching for an SQL command to see if that's allowed (to indicate if SQL in URL query strings are blocked).
@WiredWonder commented on GitHub (Feb 6, 2025):
Thanks for the reply.
ModSecurity with the CRS ruleset is the most common WAF out there. Hopefully the above helps someone.
@joshhcd commented on GitHub (May 13, 2025):
In case anyone else comes across this regarding the "Failed to Save Draft" notification when editing a page, the rule you need to allow are 949110 and 911100
So for example,
SecRule REQUEST_HEADERS:Host "yourdomain" "id:10002,phase:1,nolog,pass,ctl:ruleRemoveById=911100,ctl:ruleRemoveById=949110"I tried paring this with @WiredWonder 's recommendation, but I couldn't get it to work (I didn't do too much research into why..but I'm not having any other noticeable errors ATM other than the 2 I included)
@WiredWonder commented on GitHub (May 14, 2025):
You will find as your users start adding more content to articles that you need to remove all the rules I listed above and a couple more.
I feel like there is a smarter way to bypass them more selectively but it's beyond my ModSecurity skillset 😅