OWASP ModSecurity Core Rule Set just shipped version 4.29.0, tightening detection for backslash-prefixed shell command injection bypasses and expanding signatures for known PHP web shells. New rules flag quote-based obfuscation and stat utility invocations at Paranoia Level 2, while extensive updates to rule 942190 and rule 930120 finally fix lingering false positives in SQL detection and Node.js dependency parsing. Maintainer Felipe Zipitría merged 15 pull requests across 87 files, with peer-reviewed verification ensuring the new backslash-evasion catch catches payloads that previously slipped past alias-resolving checks. The verified release tag is now available on GitHub, though you should test the updated rules against your specific traffic before pushing to production.

OWASP ModSecurity CRS 4.29.0 Tightens Shell Evasion Detection and Web Shell Signatures

The latest open-source rule set update closes documented bypass techniques and spends equal time fixing false positives.

The OWASP ModSecurity Core Rule Set just shipped version 4.29.0. Maintainer Felipe Zipitría pushed the update today, closing a handful of documented shell command injection bypasses and adding fresh signatures for known PHP backdoors.

CRS has been the default open-source rule engine for ModSecurity for years. This release tackles techniques attackers actually use in the wild: backslash-prefixed commands that sidestep shell alias resolution, quote-based obfuscation in payload construction, and post-exploitation file enumeration via the stat utility. On top of that, the team spent a meaningful chunk of time trimming false positives across response body parsing and SQL detection rules.

Closing the Backslash Loophole

The headline change targets a trick penetration testers have known about for years. Prefixing a Unix command with a backslash (\id, \cat /etc/passwd) forces the shell to skip aliases and run the raw binary. CRS evasion detection was ignoring that pattern at the start of an injected value. PR #4599 finally closes the gap. It now flags ^\x5c across twelve rule IDs in the RCE family, including 932220, 932230, and the no-argument catch-all rules 932340 and 932350.

The review process was thorough. After a long idle period and a contributor admitting the positive tests broke in CI, Zipitría rebuilt the fix on current main, verified it against a live modsec2-apache container, and merged it after peer review. Not cheap in review cycles, but you get what you pay for in security rules. @EsadCetiner handled two other detection additions in the same cycle. Quote evasion detection wraps commands in quotes to slip past naive pattern matching, and a new PL2+ rule now flags stat invocations. That command is rarely seen in legitimate traffic, so flagging it at Paranoia Level 2 keeps the noise down while catching post-exploitation reconnaissance.

Web Shells, Cleanup, and Deployment

Web shell signatures got a refresh too. @HackingRepo added PHP backdoor entries, but after reviewer feedback requested tighter categorization, the contributor stripped out vague labels like "Unknown web shell" and verified zero false positives against a 10K English corpus.

The rest of the update leans hard into false positive reduction. Rule 942190 now demands an operator or quote after an exclamation mark, which stops your typical blog comment from tripping SQL injection alerts. Rule 932171 finally accepts a json. prefix in parameter names. A length bound on quoted literals was tightened in rule 942390 to stop bypass attempts that exploited a gap in the original logic. Maybe the most practical fix here is the restoration of node_modules detection in rule 930120. Payloads hidden inside JavaScript dependency names were slipping through after a prior regression, and this release snaps that coverage back into place. However, at the same time, the work on false positives shows the team isn't just chasing detection breadth for its own sake.

The 15 merged pull requests touched 87 files and brought seven developers into the contributor ring. Keep in mind that updating CRS is rarely a drop-in event without testing against your own traffic, but the balance between new detections and FP trimming in this release suggests it'll be a straightforward rollout for most production setups.

Head here to pull the updated rules directly from the official repository. The signature is verified with Zipitría's GPG key (4FECAA9B18A621DE) if you want to validate the build before deploying.