scenarios/http-backdoors-attempts.yaml breaks NextCloud (and other regular web apps)

[wAmpIre]

Describe the bug
Reading Apache logs from crowdsec with installed NextCloud brings up a false positive alert/decision

Reason: filenames in backdoors.txt used as regular expressions (at least I think so) and match also different filenames/URIs

To Reproduce

1. Put a file /dummy/v1.php to a PHP-enabled web server
2. Request http://.../dummy/v1.php from web server twice

Expected behavior

1. Do NOT detect/block this request
2. Search for /<FILENAME> (prefixed with slash) in http_(access|error)-log instead of <FILENAME>

Screenshots
Not a screenshot but part of detail of alert:

+---------------+--------------------------------------------+
|      Key      |                    Value                   |
+---------------+--------------------------------------------+
| http_args_len | 11                                         |
| http_path     | /ocs/v1.php/cloud/capabilities?format=json |
| http_status   | 200                                        |
| log_type      | http_access-log                            |
| service       | http                                       |
+---------------+--------------------------------------------+

[blotus]

Hello,

The scenario is looking for an exact match on the filename, not a regexp. The parser will use as a the filename whatever looks like a file first. In your example, the only part of the URI that looks like a file is v1.php, so it's going to use that.

Additionally, it's a leaky bucket: meaning that it requires more than 1 match in the log, and there's also a distinct filter on the filename meaning that 2 requests on the same file will only count as 1.

If you experience false positives, I'd encourage you to write a local whitelist or postoverflow to ignore those alerts.
If the /ocs/v1.php/cloud/capabilities?format=json is part of the default nextcloud installation (and not something based on a file you created yourself), we can add the whitelist to the existing nextcloud collection.