WAFͷϧʔϧͰ͋Δ OWASP ModSecurity Core Rule Set (CRS)Λ ࢖ͬͨՄࢹԽ·Ͱͷۤ࿑࿩ !EFMQIJO[ 08"41$POOFDU!'PMJP

໊લɿ Masahiro Tabataʢ@delphinzʣ
 
 ࢓ࣄɿγεςϜίϯαϧλϯτ 
 ηΩϡϦςΟ͸ͨ͠ͳΈఔ౓ झຯ͸ओʹङྌ࠾ूɻ
 BBQͰϚάϩͦͯ͠ಲΛ͞͹͖·͢ɻ MINI Hardening ӡӦϝϯόʔ(ϑΝγ Ϧςʔγϣϯʣ΍ͬͯ·͢♫ ࣗݾ঺հ ʹ+"84%":Ͱ08"41ͱ .*/*IBSEFOJOHΛએ఻தͷ༷ࢠ

.*/*IBSEFOJOHͰฉ͍ͨ ʢݫ͍͠ʣ͝ҙݟɾཁ๬ ɾΠϚυΩ"QBDIFͱ͔࢖Θͳ͍͠ʔʂ ɾ8"'ͱ͔ೖͬͯͳ͍αʔϏε͋Γ·͔͢ʔʁ

ΑΖ͍͠ ͳΒ͹OHJOYNPETFDVSJUZͩʂ

NPETFDVSJUZʹ$34Λఴ͑ͯ .PETFDVSJUZ w .PE4FDVSJUZ͸Φʔϓϯιʔεͷ8FCΞϓϦέʔγϣϯϑΝΠΞ΢Υʔ ϧ 8"' Ͱɺ"QBDIFɺOHJOYɺ**4ͷϞδϡʔϧͱͯ͠ಈ࡞͢Δɻ
 ։ൃ͸4QJEFS-BCT͕ߦ͍ͬͯΔɻ
 IUUQTHJUIVCDPN4QJEFS-BCT.PE4FDVSJUZ 08"41NPETFDVSJUZ$PSF3VMF4FU w 08"41͕ఏڙ͢ΔNPETFDVSJUZ༻ͷ߈ܸΛݕ஌͢Δجຊతͳϧʔϧ ηοτ
 IUUQTXXXPXBTQPSHJOEFYQIQ$BUFHPSZ08"[email protected]@$PSF@3VMF@4FU@1SPKFDU

OHJOYNPETFDVSJZͷ᠘ w "QBDIFͷ৔߹͸΄ͱΜͲͷMJOVYύοέʔδͰެࣜఏڙ͞ Ε͍ͯΔɻ
 OHJOY͸ιʔε͔ΒͷϏϧυ͕ඞཁʂ w ެࣜͲ͏Γʹ΍ͬͯ΋ઈରʹೖΒͳ͍ʂ CVJME࣌఺ͷϢʔβʔࢦఆ͕ඞཁ ύοέʔδ͕଍Γͳ͍ͱಈ͔ͳ͍ɻ
 ΤϥʔΛు͔ͳ͍ʢٽʣ

͓Αͦਓྨͷखʹෛ͑ͳ͍ ϩάग़ྗܗࣜ

ՄࢹԽπʔϧΛࢼͯ͠ΈΔ w "VEJU$POTPMF
 NPETFDVSJUZͷϩάΛ؅ཧ͢ΔͨΊʹ࡞ΒΕͨ+BWBΞϓ Ϧέʔγϣϯ
 5PNDBU্ʹల։͞Εͯ8ϒϥ΢β͔Βϩάͷऩूɺ อଘɺϑΟϧλϦϯάͳͲͷػೳΛఏڙ͢Δɻ
 IUUQXXXKXBMMPSHXFCBVEJUDPOTPMFJOEFYKTQ

͜Ε΋"VEJU$POTPMFͷ᠘͔ w +BWB͸ܾΊଧͪɺެࣜͲ͓Γͩͱ͕ೖΓಈ͔ͳ͍ w SPPUҎԼʹ഑ஔ͠ͳ͍ͱϦΞϧλΠϜϩάऔࠐෆՄ w ϦΞϧλΠϜग़ྗʹඞཁͳNMPHDʢNPETFDVSJUZͷϩάग़ ྗπʔϧʣ͸BQBDIF൛ͷΈରԠɺOHJOY͸ඇରԠ w όονܗࣜͷ୅ସπʔϧ QFSM ΋OHJOY൛Ͱ͸ಈ͔ͳ͍ w BVEJUDPOTPMF͕ఏڙ͢Δϩάૹ৴πʔϧͰ୅༻
 ʢͨͩ͠ɺҰׅૹ৴Ͱࠩ෼ૹ৴Ͱ͖ͳ͍ʣ

ແࣄʹՄࢹԽʹ੒ޭ͠·ͨ͠ʂ w ͱΓ͋͑ͣ.*/*IBSEFOJOHͰൃੜͨ͠NPETFDVSJZϩά ΛҰׅͰऔΓࠐΜͰΈΔͱ͜Μͳײ͡

͓·͚ɿ$34࡞ऀͷϫφ w 08"41ެࣜͷ$34ͷઆ໌ʹʮϥΠΞϯɾόʔωοτʯͷه ࡌ͋Γ w ʮϥΠΞϯɾόʔωοτʯͱ͍͑͹%%04ରࡦͷαʔϏεͰ
 ༗໊ͳ1SPMFYJDࣾʢͷͪʹ"LBNBJ͕ങऩʣͷ૑ۀऀ
 ʢৄࡉ͸ॻ੶ʮαΠόʔɾΫϥΠϜʯΛࢀরʣ

͡Όɺͳ͍ਓͩͬͨʂ

͓·͚ɿ$34࡞ऀͷϫφ w ޡΓ͸ʮ-ZPOʯਖ਼͘͠͸ʮ3ZBOʯͰͨ͠ɻ
 ϥΠΞϯɾόʔωοτͷ௲Γʹ஫ҙʂ
 ޡɿ ਖ਼ɿ ͪ͜Β͕$34ͷ࡞ऀͰͨ͠ʂ

݁࿦ɿPTTͷΈͰͷ8"'ೖ໳ ͸ਏ͍ɺֶ͕ͼ͸͋ͬͨ w 8"'ͷ࢓૊ΈΛ஌Δ͜ͱ͕Ͱ͖ͨɻ
 ঎༻8"'Λ࢖͑ͳ͍ਓ͸PTT͔ΒॳΊͯ΋ྑ͍͔΋ɻ w ݕ஌ઐ༻ͷઃఆʹͯ͠΍ΒΕαʔόΛ͍͡ΔͱͲΜͳΞΫηε͕ 8"'ʹҾ͔͔ͬΔ͔ݟΕΔɻ w ଞͷPTT8"'΋࣌ؒ ͱϞνϕʔγϣϯ ͕͋Ε͹ࢼͯ͠Έ͍ͨɻ w 7BHSBOU BOTJCMFͰॻ͍ͨͷͰHJUެ։͍ͨ͠ ͔΋ w ਖ਼͍͠࡞ऀ͕Θ͔ͬͨʂ

ͪΐͬͱࠂ஌ .*/*IBSEFOJOH։࠵༧ఆ w ੈքॳʂʁɹςʔϚ͸ʮԾ૝௨՟ࢢ৔ΛकΓ͖Εʂʯ w ౦ژ!:BIPPͰ։࠵ɺͦͷޙෳ਺ճ։࠵༧ఆ
 ౦ژҎ֎Ͱ͸໊ݹ԰ɺେࡕͰͷ։࠵Λௐ੔த
 ଞͷ஍ҬͰͷ։࠵ཁ๬Λ͓଴͓ͪͯ͠Γ·͢ʂ w ࢀՃر๬ͷํ͸$POOQBTTΛνΣοΫ͍ͯͩ͘͠͞ɻ IUUQTNJOJIBSEFOJOHDPOOQBTTDPN

"QQFOEJY w 8FC"QQMJDBUJPO'JSFXBMM 8"' ಡຊվగୈ̎൛
 IUUQTXXXJQBHPKQpMFTQEG
 w 08"41.PE4FDVSJUZ$PSF3VMF4FU3ZBO#BSOFUUQQU
 IUUQTXXXPXBTQPSHJOEFYQIQ 'JMF08"[email protected]@$PSF@3VMF@4FU3ZBO@#BSOFUUQQU