{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1519","repository_url":"https://api.github.com/repos/SpiderLabs/ModSecurity","labels_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1519/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1519/comments","events_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1519/events","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/1519","id":246998331,"number":1519,"title":"Serial audit log E block contains binary data","user":{"login":"lkarsten","id":108894,"avatar_url":"https://avatars3.githubusercontent.com/u/108894?v=4","gravatar_id":"","url":"https://api.github.com/users/lkarsten","html_url":"https://github.com/lkarsten","followers_url":"https://api.github.com/users/lkarsten/followers","following_url":"https://api.github.com/users/lkarsten/following{/other_user}","gists_url":"https://api.github.com/users/lkarsten/gists{/gist_id}","starred_url":"https://api.github.com/users/lkarsten/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lkarsten/subscriptions","organizations_url":"https://api.github.com/users/lkarsten/orgs","repos_url":"https://api.github.com/users/lkarsten/repos","events_url":"https://api.github.com/users/lkarsten/events{/privacy}","received_events_url":"https://api.github.com/users/lkarsten/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"zimmerle","id":428268,"avatar_url":"https://avatars3.githubusercontent.com/u/428268?v=4","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false},"assignees":[{"login":"zimmerle","id":428268,"avatar_url":"https://avatars3.githubusercontent.com/u/428268?v=4","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2017-08-01T08:49:25Z","updated_at":"2017-08-01T13:48:14Z","closed_at":null,"body":"Hi.\r\n\r\nThis was originally reported in https://github.com/SpiderLabs/ModSecurity-nginx/issues/59 , but after a bit of digging I think it belongs here.\r\n\r\nIssue: The E segment of serial logging contains binary data, possibly of uninitialized memory.\r\nExpected: Contents of the response body, mostly HTML and other human readable responses.\r\n\r\nSetup: libmodsecurity from v3/master (currently on 02426466) with modsecurity-nginx on abbf2c4.\r\n\r\nWhile developing rules I'm using the Serial audit log format, since it is easy to tail -f and truncate. The output of the E block of an audit entry looks suspicious:\r\n\r\n```\r\n---9vOuhfZZ---A--\r\n[28/Jul/2017:09:34:02 +0200] 150122724251.842785 127.0.0.1 52804 127.0.0.1 8085\r\n---9vOuhfZZ---B--\r\nGET /foo?file=/../../etc/passwd HTTP/1.1\r\nAccept-Encoding: gzip, deflate\r\nAccept: */*\r\nUser-Agent: HTTPie/0.9.8\r\nX-Forwarded-For: x.x.x.x\r\nhost: example.com\r\n---9vOuhfZZ---D--\r\n\r\n---9vOuhfZZ---E--\r\n<B3><C9>(<C9>ͱ<E3><E5><B2><C9>HML<B1><B3>)<C9>,<C9>I<B5>310Vp<CB>/J<CA>LIIͳ<DA>胕^@<95>&<E5><A7>T*$<A5>'<E7><E7><E4>^W<D9>*<95>gd<96><A4>*<81>\r\n<8C>HN<CD>+I-<B2><B3><C9>0D7^A(b<A3>^O<95>^F<D9>^ET^D<E5><E5><A5>g<E6>U<E8>ESC<EA>^Y^Z<EB>^Y!+<D1>^GY^B2T^_<EA>@^@a^Qs<8F><A9>^@^@^@<FF><FF>\r\n<FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF>\r\n<FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF>\r\n<FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF><FF>\r\n[cut]\r\n```\r\n(The large number of 0xFF here is because my nginx was just restarted, later requests have more entropy)\r\n\r\nAccording to https://github.com/SpiderLabs/ModSecurity/wiki/ModSecurity-2-Data-Formats#intended-response-body-e the E block is the intended response body.\r\n\r\nThe response body for the /foo URI is the stock nginx 403 Forbidden page. I don't think the binary representation above is of that HTML page.\r\n\r\nTo me it looks like uninitialized memory is being logged. If that is the case, it can be both confusing and downright misleading to read, depending on what the allocation heap was used for last time.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/comments/319374991","html_url":"https://github.com/SpiderLabs/ModSecurity/issues/1519#issuecomment-319374991","issue_url":"https://api.github.com/repos/SpiderLabs/ModSecurity/issues/1519","id":319374991,"user":{"login":"zimmerle","id":428268,"avatar_url":"https://avatars3.githubusercontent.com/u/428268?v=4","gravatar_id":"","url":"https://api.github.com/users/zimmerle","html_url":"https://github.com/zimmerle","followers_url":"https://api.github.com/users/zimmerle/followers","following_url":"https://api.github.com/users/zimmerle/following{/other_user}","gists_url":"https://api.github.com/users/zimmerle/gists{/gist_id}","starred_url":"https://api.github.com/users/zimmerle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zimmerle/subscriptions","organizations_url":"https://api.github.com/users/zimmerle/orgs","repos_url":"https://api.github.com/users/zimmerle/repos","events_url":"https://api.github.com/users/zimmerle/events{/privacy}","received_events_url":"https://api.github.com/users/zimmerle/received_events","type":"User","site_admin":false},"created_at":"2017-08-01T13:48:14Z","updated_at":"2017-08-01T13:48:14Z","body":"Hi @lkarsten,\r\n\r\nThere is also the possibility of this data being gzip/encoded. Can you disable the gzip compression in the end server to test it?\r\n"}}
{"actor":{"display_login":"zimmerle"}}