Bug #2510: Suricata doesnt decompress HTTP Post body - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #2510

closed

AA PA

Suricata doesnt decompress HTTP Post body

Bug #2510: Suricata doesnt decompress HTTP Post body

Added by ajaxtpm ajaxtpm almost 8 years ago. Updated over 4 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

7.0.0-beta1

Affected Versions:

Effort:

medium

Difficulty:

medium

Label:

Description

The subject is self-explained. If I send a HTTP Post request with gzipped Post body it doesnt get decompressed and cleartext inside could not be inspected by signatures.
Of course it is the IDS bypass technique.

Example signatures:
alert http any any -> any any (msg: "GZIPPED REQUEST"; flow: established, to_server; content: "name"; http_client_body; nocase; sid: 1; rev: 1; )
alert http any any -> any any (msg: "TO_SERVER |1F 8B|"; flow: established, to_server; content: "|1F 8B|"; http_client_body; sid: 2; rev: 1; )

Pcap Attached

Expectation: alert sid 1
Reality: alert sid 2

Files

gzip_post.pcap (1.23 KB) gzip_post.pcap

ajaxtpm ajaxtpm, 06/04/2018 04:55 PM

Related issues 1 (0 open — 1 closed)

AH Updated by Andreas Herz almost 8 years ago Actions
Copy link
#1

Assignee set to OISF Dev
Target version set to TBD
Private changed from No to Yes
Effort set to medium
Difficulty set to medium

thanks for reporting, we will look into that

VJ Updated by Victor Julien over 7 years ago Actions
Copy link
#2

Libhtp, which does the decompression on the response body side, simply doesn't implement decompression for request bodies. So addressing this issue would involve adding this support to libhtp or implementing it in Suricata itself somehow.

AA Updated by ajaxtpm ajaxtpm over 7 years ago Actions
Copy link
#3

Victor Julien wrote:

Libhtp, which does the decompression on the response body side, simply doesn't implement decompression for request bodies. So addressing this issue would involve adding this support to libhtp or implementing it in Suricata itself somehow.

Hi Victor, should I submit this issue to libhtp github and close this one?