Bug #2510: Suricata doesnt decompress HTTP Post body - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #2510

closed

Suricata doesnt decompress HTTP Post body

Added by ajaxtpm ajaxtpm almost 6 years ago. Updated over 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

7.0.0-beta1

Affected Versions:

Effort:

medium

Difficulty:

medium

Label:

Description

The subject is self-explained. If I send a HTTP Post request with gzipped Post body it doesnt get decompressed and cleartext inside could not be inspected by signatures.
Of course it is the IDS bypass technique.

Example signatures:
alert http any any -> any any (msg: "GZIPPED REQUEST"; flow: established, to_server; content: "name"; http_client_body; nocase; sid: 1; rev: 1; )
alert http any any -> any any (msg: "TO_SERVER |1F 8B|"; flow: established, to_server; content: "|1F 8B|"; http_client_body; sid: 2; rev: 1; )

Pcap Attached

Expectation: alert sid 1
Reality: alert sid 2

Files

gzip_post.pcap (1.23 KB) gzip_post.pcap

ajaxtpm ajaxtpm, 06/04/2018 04:55 PM

Related issues 1 (0 open — 1 closed)

Actions

Copy link

Updated by Andreas Herz almost 6 years ago

Assignee set to OISF Dev
Target version set to TBD
Private changed from No to Yes
Effort set to medium
Difficulty set to medium

thanks for reporting, we will look into that

Actions

Copy link

Updated by Victor Julien almost 6 years ago

Libhtp, which does the decompression on the response body side, simply doesn't implement decompression for request bodies. So addressing this issue would involve adding this support to libhtp or implementing it in Suricata itself somehow.

Actions

Copy link

Updated by ajaxtpm ajaxtpm almost 6 years ago

Victor Julien wrote:

Libhtp, which does the decompression on the response body side, simply doesn't implement decompression for request bodies. So addressing this issue would involve adding this support to libhtp or implementing it in Suricata itself somehow.

Hi Victor, should I submit this issue to libhtp github and close this one?

Actions

Copy link