Hello 🙂,
I'm trying to make Coraza write its logs in the JSON format.
I'm using the following versions:
coraza-proxy-wasm-0.6.0apisix:3.15.0
And this ApisixPluginConfig
apiVersion: apisix.apache.org/v2
kind: ApisixPluginConfig
metadata:
name: my-config
namespace: sandbox-test-waf
spec:
ingressClassName: ingress-apisix
plugins:
- name: wasm-coraza
enable: true
config:
conf:
directives_map:
default:
- SecDebugLogLevel 9
- SecRuleEngine On
- SecRequestBodyAccess On
- SecAuditLogType Serial
- SecAuditLogFormat JSON
- SecAuditLogParts ABCEFGHIJKZ
- SecAuditLog /dev/stdout
- Include @crs-setup-conf
- Include @owasp_crs/*.conf
default_directives: default
Coraza blocks the request as expected:
$ curl https://test-waf.sandbox.acme.com\?f\=/dev/tcp/127
<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>openresty</center>
<p><em>Powered by <a href="https://apisix.apache.org/">APISIX</a>.</em></p></body>
</html>
But I see the following logs in the stdout
apisix-8556b64898-h78jj apisix 2026/03/27 17:14:39 [emerg] 83#83: *831362 [client ""] Coraza: Warning. Remote Command Execution: Unix Shell Code Found [file "@owasp_crs/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "5225"] [id "932160"] [rev ""] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: dev/tcp found within ARGS_GET:f: /dev/tcp/127"] [severity "critical"] [ver "OWASP_CRS/4.14.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-RCE"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname ""] [uri "/?f=/dev/tcp/127"] [unique_id "gAmVNCvYNRJnLbkUrsV"], client: x.x.x.x, server: _, request: "GET /?f=/dev/tcp/127 HTTP/1.1", host: "test-waf.sandbox.acme.com", request_id: "9aecf524e52f0db0da5ece516cd720ec"
apisix-8556b64898-h78jj apisix 2026/03/27 17:14:39 [emerg] 83#83: *831362 [client ""] Coraza: Access denied (phase 1). Inbound Anomaly Score Exceeded in phase 1 (Total Score: 5) [file "@owasp_crs/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "11725"] [id "949111"] [rev ""] [msg "Inbound Anomaly Score Exceeded in phase 1 (Total Score: 5)"] [data ""] [severity "emergency"] [ver "OWASP_CRS/4.14.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname ""] [uri "/?f=/dev/tcp/127"] [unique_id "gAmVNCvYNRJnLbkUrsV"], client: x.x.x.x, server: _, request: "GET /?f=/dev/tcp/127 HTTP/1.1", host: "test-waf.sandbox.acme.com", request_id: "9aecf524e52f0db0da5ece516cd720ec"
apisix-8556b64898-h78jj apisix x.x.x.x - - [27/Mar/2026:17:14:38 +0000] x.x.x.x:9180 "PUT /apisix/admin/configs HTTP/1.1" 204 0 0.000 "-" "axios/1.13.2" - - - "http://x.x.x.x:9180"
apisix-8556b64898-h78jj apisix x.x.x.x - - [27/Mar/2026:17:14:39 +0000] test-waf.sandbox.acme.com "GET /?f=/dev/tcp/127 HTTP/1.1" 403 225 0.000 "-" "curl/8.5.0" - - - "http://test-waf.sandbox.acme.com"
❓ What does this log mean? That the JSON writer has falled back to a default log formatter?
❓ Is there any debug mode I could activate?
Thanks for your advice 🙂
Hello 🙂,
I'm trying to make Coraza write its logs in the JSON format.
I'm using the following versions:
coraza-proxy-wasm-0.6.0apisix:3.15.0And this
ApisixPluginConfigCoraza blocks the request as expected:
But I see the following logs in the
stdout❓ What does this log mean? That the JSON writer has falled back to a default log formatter?
❓ Is there any debug mode I could activate?
Thanks for your advice 🙂