web_server: PHP.CGI.Argument.Injection detection by mod_secure?

newbie14 · 07-10-2013, 09:05 AM

Hi,
Today our firewall detect this intrusion "web_server: PHP.CGI.Argument.Injection". We have a centos 6.4 machine with php 5.3.3 and with mod_secure enabled. We are wondering can mod_secure detect this type of intrusion and disabled it? What can we do to scan if there is any threat created? I have checked through the httpd access log and I didnt find the said ip detected by the firewall.

David Trest · 07-10-2013, 09:46 AM

The firewall (what kind of firewall?) probably just blocked the event so your webserver didn't see it.

mod_security, with proper rules (such as OWASP) can detect many well-known injection rules, plus ones that just plain look squirrelly.

But you are running an application that sanitizes inputs, making injection all that much harder, right?

newbie14 · 07-10-2013, 11:22 AM

Dear David,
The firewall is fortinet. When you say sanitize means is it that things like mysql_real_escape_string? Yes I do this is on my login page anything else should I be doing ?

David Trest · 07-10-2013, 12:49 PM

As long as you sanitize your input so someone can't put content in there that MySQL or any other interpreter will try to execute as code, you'll be fine.

But it still doesn't hurt to load mod_security rules like OWASP or others, prevents someone from piling in junk data anyways.

newbie14 · 07-10-2013, 01:09 PM

I am not too sure is mysql_real_escape_string sufficient enough? Yes I have mod_secure running too what should I edit or change to edit to further harden it I just left it as it is without any additional changes?

David Trest · 07-10-2013, 02:07 PM

That's something in your firewall, you'll need to confer with Fortinet about that. I don't know much about them.

Here's some information about the OWASP mod_security stuff: https://www.owasp.org/index.php/Cate...le_Set_Project

newbie14 · 07-10-2013, 10:55 PM

Well on the php and apache should I do anything extra? What else can I use to sanitize my web pages from your experience? I have mod_security enable even before this too. Should I upgrade the rules or it can be done via the normal yum updates?