The mod_security configuration in Apache, on the CWP7.admin, generates a 403 access denied error when running Grav CMS:
[Thu Mar 21 15:40:47.967502 2019] [:error] [pid 21727:tid 140715786946304] [client 186.67.206.59:57900] [client 186.67.206.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "([\\~\\!\\#\\#\\$\\%\\^\\&\\*\\(\\)\\-\\+\\=\\{\\}\\[\\]\\|\\:\\;\"\\'\\\xc2\xb4\\\xe2\x80\x99\\\xe2\x80\x98\\`\\<\\>].*?){8,}" at REQUEST_COOKIES:grav-tabs-state. [file "/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "157"] [id "981172"] [rev "2"] [msg "Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded"] [data "Matched Data: \x22 found within REQUEST_COOKIES:grav-tabs-state: {\x22tab-content.options.advanced\x22:\x22data.content\x22,\x22tab-content.options\x22:\x22data.content\x22,\x22tab-content.options.advanced.blog\x22:\x22data.options\x22}"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [hostname "xxxxxxxx.com"] [uri "/favicon.ico"] [unique_id "XJOwf0cQATwA6mgjE8O7AwAAANc"], referer: http://xxxxxxxx.com/
This error only happens when visiting the website a second time, making it very hard to solve.
Upon inspecting the logs, I found the same pattern of errors for Grav CMS based sites generated by mod_security. This answer by Barry Pollard guided my solution
The error noted the mod_security rule blocking my request:
/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
the corresponding line
[line "157"]
And its ID
[id "981172"]
Using the advice from Barry , I added the following line after the rule:
SecRuleUpdateTargetById 981172 !REQUEST_COOKIES:grav-tabs-state
In this case I'm asking mod_security to omit REQUEST_COOKIES:grav-tabs-state from the rule 981172. This solved the issue.
Thanks from the bottom of my heart to #barrypollard
Related
my server return 405, Method Not Allowed when request to https with http_method DELETE, but request to http is ok. Can anyone please help ?
Server Environment
Apache 2.4.29
DirectAdmin 1.52.1
OS: centOS release 6.9 (Final)
Thanks
Add Error log
[Wed Jan 03 11:57:38.331926 2018] [allowmethods:error] [pid 8569] [client 171.97.62.152:59633] AH01623: client method denied by server configuration: 'DELETE' to /home/------/domains/------.com/private_html/
The sure way to fix this is to learn why Apache denies the requests in your particular case. You can learn this from its error logs.
In my case, tail -f /usr/local/apache/logs/error_log
gave this:
[Tue 2 08:39:52.570672 2018] [:error] [pid 32076:tid 140086307448576]
[client 93.125.93.77] ModSecurity: Access denied with code 501 (phase 2).
Match of "rx ^((?:(?:POS|GE)T|OPTIONS|HEAD))$" against "REQUEST_METHOD"
required. [file "/usr/local/apache/conf/modsec-imh/01_base_rules.conf"] [line
"32"] [id "960032"] [msg "Method is not allowed by policy"] [severity
"CRITICAL"] [tag "POLICY/METHOD_NOT_ALLOWED"] [hostname "104.244.122.237"]
[uri "/products/order/items/45"] [unique_id "V96LGGj0eu0AAH1MR8sAAACB"]
It mentions a security rule and the file it's coming from:
/usr/local/apache/conf/modsec-imh/01_base_rules.conf. Editing that file solved my problem smoothly.
I have a cPanel server with apache 2.4 and Maldetect, ClamAV. I want to have realtime malware scanner on server to block hackers from uploading malicious files on server. What i meant is when someone uploads a file, apache will invoke the scanner using mod-security 2.9 and scan the uploaded file.
If it's found as malware - should get rejected.
If it's found good file - should upload to correct destination.
I have tried to do this with following settings as described in https://www.rfxn.com/appdocs/README.maldetect
To enable upload scanning with mod_security2 you must set enable the public_scan option
in conf.maldet (public_scan=1) then add the following rules to your mod_security2
configuration. These rules are best placed in your modsec2.user.conf file on cpanel servers
or at the top of the appropraite rules file for your setup.
/usr/local/apache/conf/modsec2.user.conf (or similar mod_security2 rules file):
SecRequestBodyAccess On
SecRule FILES_TMPNAMES "#inspectFile /usr/local/maldetect/hookscan.sh" \
"id:'999999',log,auditlog,deny,severity:2,phase:2,t:none"
If using ModSecurity >=2.9, you should set 'SecTmpSaveUploadedFiles On' before the
'SecRule FILES_TMPNAMES' line.
A restart of the Apache service is required following these changes.
But the problem is all the files are getting rejected by doing this, even good files. Is there anything wrong with the above setup?
# cat /usr/local/apache/conf/modsec2.user.conf
### UPLOAD PARAMETERS BEGIN ####
SecUploadDir /tmp
SecTmpDir /tmp/
SecDataDir /tmp/
SecUploadKeepFiles RelevantOnly
### UPLOAD PARAMETERS END ####
SecRequestBodyAccess On
SecTmpSaveUploadedFiles On
SecRule FILES_TMPNAMES "#inspectFile /usr/local/maldetect/hookscan.sh" \
"id:'999999',log,auditlog,deny,severity:2,phase:2,t:none"
Following is the error in logs
[Sun Mar 05 21:11:35.936553 2017] [:error] [pid 9800] [client x.x.x.x] ModSecurity: Access denied with code 406 (phase 2). File "/tmp/20170305-211135-WLxNz#kP#rKcABIc7ZF3lAAAAAM-file-SfujtQ" rejected by the approver script "/usr/local/maldetect/hookscan.sh": Linux Malware Detect v1.5 [file "/usr/local/apache/conf/modsec2.user.conf"] [line "13"] [id "999999"] [severity "CRITICAL"] [hostname "x.x.x.x"] [uri "/test.php"] [unique_id "WLxNz#kP#rKcABIc7ZF3lAAAAAM"]
[Sun Mar 05 21:11:44.511418 2017] [:error] [pid 9526] [client x.x.x.x] ModSecurity: Access denied with code 406 (phase 2). File "/tmp/20170305-211144-WLxN2EJsvK1FL3paCDmxrgAAAAE-file-iQx2zR" rejected by the approver script "/usr/local/maldetect/hookscan.sh": Linux Malware Detect v1.5 [file "/usr/local/apache/conf/modsec2.user.conf"] [line "13"] [id "999999"] [severity "CRITICAL"] [hostname "x.x.x.x"] [uri "/test.php"] [unique_id "WLxN2EJsvK1FL3paCDmxrgAAAAE"]
I had this issue too. Problem is this line:
SecTmpSaveUploadedFiles On
Try to remove it from the rule.
I have Apache 2.4 and mod_security 2.9.1 installed, and it is working, with some very basic rules.
I am trying to make a POST request that includes some header information, but doesn't have anything in the request body (the request is to an API endpoint which is being protected by mod_security, and that endpoint requires a POST without the request body). A POST that doesn't require a body is valid, per the following: Are PUT and POST requests required/expected to have a request body?
mod_security is blocking the request because it seems that it can't parse/format the body (likely because it doesn't exist).
How can I amend the rules to permit a POST without a body, but otherwise act as normal if the body does exist.
The specific rule that is being triggered is:
SecRule REQBODY_ERROR "!#eq 0" \
"id:'200002', phase:2,t:none,log,deny,status:415,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"
The error is:
[Fri Jul 08 10:32:32.901230 2016] [:error] [pid 7697] [client 10.0.2.2:57442] [client 10.0.2.2] ModSecurity: JSON parser error: parse error: premature EOF\n [hostname "example.com"] [uri "/api/v1/logout"] [unique_id "V377qH8AAQEAAB4RU6cAAAAD"]
[Fri Jul 08 10:32:32.901555 2016] [:error] [pid 7697] [client 10.0.2.2:57442] [client 10.0.2.2] ModSecurity: Access denied with code 415 (phase 2). Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "61"] [id "200002"] [msg "Failed to parse request body."] [data "JSON parser error: parse error: premature EOF\\x0a"] [severity "CRITICAL"] [hostname "example.com"] [uri "/api/v1/logout"] [unique_id "V377qH8AAQEAAB4RU6cAAAAD"]
Or, should I simply not send a Content-Type HTTP header in order to get mod_security to parse the body (although I'd prefer to enforce that all POST requests always have a defined Content-Type)?
I've made a gist of the full modsecurity.conf that is being used (which is a basic example with two extra rules for filtering Content-Types).
You can disable body access for a request with zero body length:
SecRule REQUEST_BODY_LENGTH "#eq 0" "id:12345,phase:1,nolog,ctl:requestBodyAccess=off"
Or if you only want to do this on a certain URL then use a chained rule like this:
SecRule REQUEST_URI /my/weird/api "phase:1,id:12346,nolog,chain"
SecRule REQUEST_BODY_LENGTH "#eq 0" "ctl:requestBodyAccess=off"
I could use some advice on whitelisting JSON ARGS_NAMES that modsecurity seems to complain about. I'm not sure how to properly specify the ARGS_NAMES for a JSON Request. My app uses JSON heavily, so there are a few of these alerts for different style requests.
The following alert is triggered by a POST request (sign-in/authentication) to my backend application:
2015-08-06T23:02:21.09022 [Thu Aug 06 23:02:21.090206 2015] [:error] [pid > 18099:tid 140155981653760] [client 192.168.216.16] ModSecurity: Warning. > Pattern match "(?i:(?:union\\s*?(?:all|distinct|[(!#]?)?\\s?[([]? \\s?select\\s+)|(?:\\w+\\s+like\\s+> [\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98])|(?:like\\\\s*? [\\"'\xc2\xb4\xe2\x80\x99\xe2\x80\x98]\\%)|(?: [\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98]\\\\s*?like\\\\W*? [\\"'\xc2\xb4 ..." at ARGS_NAMES: {"username":"userid2","password":"blahblah"}. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "223"] [id "981245"] [msg "Detects basic SQL authentication bypass attempts 2/3"] [data "Matched Data: \x22:\x22userid2\x22,\x22p found within ARGS_NAMES: {\x22username\x22:\x22userid2\x22,\x22password\x22:\x22blahblah\x22 }:{\x22username\x22:\x22userid2\x22,\x22password\x22:\x22blahblah\x22 }"] [severity "CRITICAL"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"][hostname "api.host.name"] [uri "/user-api/auth-service"] [unique_id "VcPnfQobAhEAAEazjWUAAABB"]
Here's another alert triggered by an AJAX update to a user's session data:
2015-07-22T22:02:03.61377 [Wed Jul 22 22:02:03.613737 2015] [:error] [pid > 14702:tid 140281273739008] [client 10.72.2.5] ModSecurity: Access denied > with code 403 (phase 2). Pattern match "(.*)" at TX:981257-Detects MySQL > comment-/space-obfuscated injections and backtick termination- OWASP_CRS/WEB_ATTACK/SQLI-ARGS_NAMES:{"data":{"categories": [{"uuid":"10009","name":"Books","folder":"School"}],"category_ids": ["188"],"transaction_ids":["ed529b9f47ee-ab23-5b98-4404-d59a86b9","ed529b9f47ee-ab23-5b98-4404-d59a86b9","ed529b9f47ee-ab23-5b98-4404-d59a86b9"]}}. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_49_inbound_blocking.conf"] [line "26"][id "981176"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20, SQLi=4, XSS=0): Last Matched Message: 981243-Detects classic SQL injection probings 2/2"] [data "Last Matched Data: ,\x22name\x22:"] [hostname "host.name.com"] [uri "/new/data"] [unique_id "VbAS2wobA80AADluSjYAAADw"]
How can I create a whitelist for "ARGS_NAMES:{"username[..]" or "ARGS_NAMES:{data[..]"? When I try to whitelist with regex, I wind up with a rule like this:
SecRule ARGS_NAMES:"({\"(data)\":)(({\"[a-z_]+\":).)" "(.)" "id:308,phase:2,t:none,nolog,pass,ctl:ruleRemoveTargetByTag=.;ARGS_NAMES:({\"(data)\":)(({\"[a-z_]+\":).)"
I believe this works unless PCRE limits exceeded, from testing. Is there an easier way to do this for JSON arguments?
Here's another method I tried in an earlier iteration of my whitelists:
SecRule ARGS:data.transaction_ids "(([a-z0-9-]))" "id:206,phase:2,nolog,pass,ctl:ruleRemoveTargetByTag=.;ARGS:data.transaction_ids,ctl:ruleRemoveTargetById=960024;ARGS:data.transaction_ids"
To the best of my knowledge this works, but I want to be able to whitelist any request that uses the "{data:" JSON format within the request body. I want to verify the correct method of whitelisting JSON arguments before I go in for another round of testing.
What am I missing here?
I am gettign this error code on submititng the form.
That form have rich text editors and I am assuming that is the problem.
So from erorr log I found out this message:
[Sat Sep 13 18:45:11 2014] [error] [client xx.xx.xx.xx] ModSecurity: [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1023"] [id "350147"] [rev "147"] [msg "Atomicorp.com WAF Rules: Potentially Untrusted Web Content Detected"] [data "10862"] [severity "CRITICAL"] Access denied with code 403 (phase 2). Match of "rx ((?:submit(?:\\\\+| )?(request)?(?:\\\\+| )?>+|<<(?:\\\\+| )remove|(?:sign ?in|log ?(?:in|out)|next|modifier|envoyer|add|continue|weiter|account|results|select)(?:\\\\+| )?>+)$|^< ?\\\\??(?: |\\\\+)?xml|^<samlp|^>> ?$)" against "REQUEST_URI" required. [hostname "example.com"] [uri "/add-product/"] [unique_id "VBTzJkJVoVIAAGGuSEgAAAAT"]
So what is this error and can anyone tell me how to fix this?
After this error being displayd every access to the server is blocked from 10 to 15 minutes?
The client have full access to server so that is not the problem.
It is standard LAMP environment.
Thanks!