Skip to content

Commit 4e08c28

Browse files
fzipifzipi
authored
chore: release v4.13.0 (#4070)
Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org>
1 parent 3be3ac7 commit 4e08c28

30 files changed

+678
-649
lines changed

‎CHANGES.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,35 @@
55
or the CRS Google Group at
66
* https://groups.google.com/a/owasp.org/g/modsecurity-core-rule-set-project
77

8+
## Version 4.13.0 - 2025-03-31
9+
10+
## What's Changed
11+
### ⭐ Important changes
12+
* fix(security): fixing double URL decode of REQUEST_URI by @azurit in https://github.com/coreruleset/coreruleset/pull/4047
13+
### 🆕 New features and detections 🎉
14+
* feat: block header related to CVE-2025-29927 (Next.js) by @azurit in https://github.com/coreruleset/coreruleset/pull/4053
15+
* feat: added new XSS payloads by @Xhoenix in https://github.com/coreruleset/coreruleset/pull/4055
16+
* feat: add potential malicious file extensions into tx.restricted_extensions by @Xhoenix in https://github.com/coreruleset/coreruleset/pull/4068
17+
* feat: add additional files commonly accessed by bots by @EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4069
18+
### 🪦 Rule removals
19+
* feat: remove rule 952100 for detecting Java Source Code Leakage by @S0obi in https://github.com/coreruleset/coreruleset/pull/4052
20+
### 🧰 Other Changes
21+
* fix(934130): extend prototype pollution payload by @Xhoenix in https://github.com/coreruleset/coreruleset/pull/4036
22+
* fix: rule 930110 is not supposed to match bare '..' without (back)slashes by @azurit in https://github.com/coreruleset/coreruleset/pull/4050
23+
* fix: use boundary to fix false positive with email `firstname.dockery@host.tld` by @EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4045
24+
* feat: refresh restricted-upload.data by @S0obi in https://github.com/coreruleset/coreruleset/pull/4046
25+
* fix: tag inconsistency per file by @Xhoenix in https://github.com/coreruleset/coreruleset/pull/4031
26+
* feat: adding .dist and .dpkg-dist into tx.restricted_extensions by @azurit in https://github.com/coreruleset/coreruleset/pull/4057
27+
* feat: add more default session cookie names by @Xhoenix in https://github.com/coreruleset/coreruleset/pull/4062
28+
* fix: added pre-check of unset TX variable by @airween in https://github.com/coreruleset/coreruleset/pull/4066
29+
* fix: false positive found in quantitative testing round 2 for unix rce rules (932230 PL-1, 932235 PL-1, 932250 PL-1, 932260 PL-1, 932231 PL-2, 932220 PL-2, 932236 PL-2, 932239 PL-2, 932232 PL-3, 932238 PL-3) by @EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4019
30+
31+
## New Contributors
32+
* @daum3ns made their first contribution in https://github.com/coreruleset/coreruleset/pull/4043
33+
* @S0obi made their first contribution in https://github.com/coreruleset/coreruleset/pull/4046
34+
35+
**Full Changelog**: https://github.com/coreruleset/coreruleset/compare/v4.12.0...v4.13.0
36+
837
## Version 4.12.0 - 2025-03-01
938

1039
## What's Changed

‎SECURITY.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ Along those lines, OWASP CRS team may not issue security notifications for unsup
1111

1212
| Version | Supported |
1313
| --------- | ------------------ |
14+
| 4.13.z | :white_check_mark: |
1415
| 4.12.z | :white_check_mark: |
15-
| 4.11.z | :white_check_mark: |
1616
| 4.y.z | :x: |
1717
| 3.3.x | :white_check_mark: |
1818
| 3.2.x | :x: |

‎crs-setup.conf.example‎

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# ------------------------------------------------------------------------
2-
# OWASP CRS ver.4.13.0-dev
2+
# OWASP CRS ver.4.13.0
33
# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
44
# Copyright (c) 2021-2025 CRS project. All rights reserved.
55
#
@@ -181,7 +181,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
181181
# t:none,\
182182
# nolog,\
183183
# tag:'OWASP_CRS',\
184-
# ver:'OWASP_CRS/4.13.0-dev',\
184+
# ver:'OWASP_CRS/4.13.0',\
185185
# setvar:tx.blocking_paranoia_level=1"
186186

187187

@@ -209,7 +209,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
209209
# t:none,\
210210
# nolog,\
211211
# tag:'OWASP_CRS',\
212-
# ver:'OWASP_CRS/4.13.0-dev',\
212+
# ver:'OWASP_CRS/4.13.0',\
213213
# setvar:tx.detection_paranoia_level=1"
214214

215215

@@ -235,7 +235,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
235235
# t:none,\
236236
# nolog,\
237237
# tag:'OWASP_CRS',\
238-
# ver:'OWASP_CRS/4.13.0-dev',\
238+
# ver:'OWASP_CRS/4.13.0',\
239239
# setvar:tx.enforce_bodyproc_urlencoded=1"
240240

241241

@@ -270,7 +270,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
270270
# t:none,\
271271
# nolog,\
272272
# tag:'OWASP_CRS',\
273-
# ver:'OWASP_CRS/4.13.0-dev',\
273+
# ver:'OWASP_CRS/4.13.0',\
274274
# setvar:tx.critical_anomaly_score=5,\
275275
# setvar:tx.error_anomaly_score=4,\
276276
# setvar:tx.warning_anomaly_score=3,\
@@ -324,7 +324,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
324324
# t:none,\
325325
# nolog,\
326326
# tag:'OWASP_CRS',\
327-
# ver:'OWASP_CRS/4.13.0-dev',\
327+
# ver:'OWASP_CRS/4.13.0',\
328328
# setvar:tx.inbound_anomaly_score_threshold=5,\
329329
# setvar:tx.outbound_anomaly_score_threshold=4"
330330

@@ -385,7 +385,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
385385
# t:none,\
386386
# nolog,\
387387
# tag:'OWASP_CRS',\
388-
# ver:'OWASP_CRS/4.13.0-dev',\
388+
# ver:'OWASP_CRS/4.13.0',\
389389
# setvar:tx.reporting_level=4"
390390

391391

@@ -417,7 +417,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
417417
# t:none,\
418418
# nolog,\
419419
# tag:'OWASP_CRS',\
420-
# ver:'OWASP_CRS/4.13.0-dev',\
420+
# ver:'OWASP_CRS/4.13.0',\
421421
# setvar:tx.early_blocking=1"
422422

423423

@@ -438,7 +438,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
438438
# t:none,\
439439
# nolog,\
440440
# tag:'OWASP_CRS',\
441-
# ver:'OWASP_CRS/4.13.0-dev',\
441+
# ver:'OWASP_CRS/4.13.0',\
442442
# setvar:tx.enable_default_collections=1"
443443

444444

@@ -476,7 +476,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
476476
# t:none,\
477477
# nolog,\
478478
# tag:'OWASP_CRS',\
479-
# ver:'OWASP_CRS/4.13.0-dev',\
479+
# ver:'OWASP_CRS/4.13.0',\
480480
# setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"
481481

482482
# Content-Types that a client is allowed to send in a request.
@@ -514,7 +514,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
514514
# nolog,\
515515
# tag:'OWASP_CRS',\
516516
# ctl:ruleRemoveById=920420,\
517-
# ver:'OWASP_CRS/4.13.0-dev',\
517+
# ver:'OWASP_CRS/4.13.0',\
518518
# chain"
519519
# SecRule REQUEST_URI "@rx ^/foo/bar" \
520520
# "t:none"
@@ -528,7 +528,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
528528
# t:none,\
529529
# nolog,\
530530
# tag:'OWASP_CRS',\
531-
# ver:'OWASP_CRS/4.13.0-dev',\
531+
# ver:'OWASP_CRS/4.13.0',\
532532
# setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |text/xml| |application/xml| |application/soap+xml| |application/json|'"
533533

534534
# Allowed HTTP versions.
@@ -544,7 +544,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
544544
# t:none,\
545545
# nolog,\
546546
# tag:'OWASP_CRS',\
547-
# ver:'OWASP_CRS/4.13.0-dev',\
547+
# ver:'OWASP_CRS/4.13.0',\
548548
# setvar:'tx.allowed_http_versions=HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0'"
549549

550550
# Forbidden file extensions.
@@ -568,7 +568,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
568568
# t:none,\
569569
# nolog,\
570570
# tag:'OWASP_CRS',\
571-
# ver:'OWASP_CRS/4.13.0-dev',\
571+
# ver:'OWASP_CRS/4.13.0',\
572572
# setvar:'tx.restricted_extensions=.ani/ .application/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .scr/ .sct/ .shs/ .sql/ .swp/ .sys/ .tlb/ .tmp/ .ttf/ .url/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/'"
573573

574574
# Restricted request headers.
@@ -616,7 +616,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
616616
# t:none,\
617617
# nolog,\
618618
# tag:'OWASP_CRS',\
619-
# ver:'OWASP_CRS/4.13.0-dev',\
619+
# ver:'OWASP_CRS/4.13.0',\
620620
# setvar:'tx.restricted_headers_basic=/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/'"
621621
#
622622
# [ Extended ]
@@ -642,7 +642,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
642642
# t:none,\
643643
# nolog,\
644644
# tag:'OWASP_CRS',\
645-
# ver:'OWASP_CRS/4.13.0-dev',\
645+
# ver:'OWASP_CRS/4.13.0',\
646646
# setvar:'tx.restricted_headers_extended=/accept-charset/'"
647647

648648
# Content-Types charsets that a client is allowed to send in a request.
@@ -661,7 +661,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
661661
# t:none,\
662662
# nolog,\
663663
# tag:'OWASP_CRS',\
664-
# ver:'OWASP_CRS/4.13.0-dev',\
664+
# ver:'OWASP_CRS/4.13.0',\
665665
# setvar:'tx.allowed_request_content_type_charset=|utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|'"
666666

667667
#
@@ -687,7 +687,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
687687
# t:none,\
688688
# nolog,\
689689
# tag:'OWASP_CRS',\
690-
# ver:'OWASP_CRS/4.13.0-dev',\
690+
# ver:'OWASP_CRS/4.13.0',\
691691
# setvar:tx.max_num_args=255"
692692

693693
# Block request if the length of any argument name is too high
@@ -701,7 +701,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
701701
# t:none,\
702702
# nolog,\
703703
# tag:'OWASP_CRS',\
704-
# ver:'OWASP_CRS/4.13.0-dev',\
704+
# ver:'OWASP_CRS/4.13.0',\
705705
# setvar:tx.arg_name_length=100"
706706

707707
# Block request if the length of any argument value is too high
@@ -715,7 +715,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
715715
# t:none,\
716716
# nolog,\
717717
# tag:'OWASP_CRS',\
718-
# ver:'OWASP_CRS/4.13.0-dev',\
718+
# ver:'OWASP_CRS/4.13.0',\
719719
# setvar:tx.arg_length=400"
720720

721721
# Block request if the total length of all combined arguments is too high
@@ -729,7 +729,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
729729
# t:none,\
730730
# nolog,\
731731
# tag:'OWASP_CRS',\
732-
# ver:'OWASP_CRS/4.13.0-dev',\
732+
# ver:'OWASP_CRS/4.13.0',\
733733
# setvar:tx.total_arg_length=64000"
734734

735735
# Block request if the file size of any individual uploaded file is too high
@@ -743,7 +743,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
743743
# t:none,\
744744
# nolog,\
745745
# tag:'OWASP_CRS',\
746-
# ver:'OWASP_CRS/4.13.0-dev',\
746+
# ver:'OWASP_CRS/4.13.0',\
747747
# setvar:tx.max_file_size=1048576"
748748

749749
# Block request if the total size of all combined uploaded files is too high
@@ -757,7 +757,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
757757
# t:none,\
758758
# nolog,\
759759
# tag:'OWASP_CRS',\
760-
# ver:'OWASP_CRS/4.13.0-dev',\
760+
# ver:'OWASP_CRS/4.13.0',\
761761
# setvar:tx.combined_file_sizes=1048576"
762762

763763

@@ -797,7 +797,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
797797
# pass,\
798798
# nolog,\
799799
# tag:'OWASP_CRS',\
800-
# ver:'OWASP_CRS/4.13.0-dev',\
800+
# ver:'OWASP_CRS/4.13.0',\
801801
# setvar:tx.sampling_percentage=100"
802802

803803

@@ -818,7 +818,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
818818
# t:none,\
819819
# nolog,\
820820
# tag:'OWASP_CRS',\
821-
# ver:'OWASP_CRS/4.13.0-dev',\
821+
# ver:'OWASP_CRS/4.13.0',\
822822
# setvar:tx.crs_validate_utf8_encoding=1"
823823

824824
# -- [[ Skip Checking Responses ]] ------------------------------------------------
@@ -840,7 +840,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
840840
# t:none,\
841841
# nolog,\
842842
# tag:'OWASP_CRS',\
843-
# ver:'OWASP_CRS/4.13.0-dev',\
843+
# ver:'OWASP_CRS/4.13.0',\
844844
# setvar:tx.crs_skip_response_analysis=1"
845845

846846
#
@@ -861,5 +861,5 @@ SecAction \
861861
t:none,\
862862
nolog,\
863863
tag:'OWASP_CRS',\
864-
ver:'OWASP_CRS/4.13.0-dev',\
864+
ver:'OWASP_CRS/4.13.0',\
865865
setvar:tx.crs_setup_version=4130"

‎rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# ------------------------------------------------------------------------
2-
# OWASP CRS ver.4.13.0-dev
2+
# OWASP CRS ver.4.13.0
33
# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
44
# Copyright (c) 2021-2025 CRS project. All rights reserved.
55
#

0 commit comments

Comments
 (0)