I am gettign this error code on submititng the form.
That form have rich text editors and I am assuming that is the problem.
So from erorr log I found out this message:
[Sat Sep 13 18:45:11 2014] [error] [client xx.xx.xx.xx] ModSecurity: [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "1023"] [id "350147"] [rev "147"] [msg "Atomicorp.com WAF Rules: Potentially Untrusted Web Content Detected"] [data "10862"] [severity "CRITICAL"] Access denied with code 403 (phase 2). Match of "rx ((?:submit(?:\\\\+| )?(request)?(?:\\\\+| )?>+|<<(?:\\\\+| )remove|(?:sign ?in|log ?(?:in|out)|next|modifier|envoyer|add|continue|weiter|account|results|select)(?:\\\\+| )?>+)$|^< ?\\\\??(?: |\\\\+)?xml|^<samlp|^>> ?$)" against "REQUEST_URI" required. [hostname "example.com"] [uri "/add-product/"] [unique_id "VBTzJkJVoVIAAGGuSEgAAAAT"]
So what is this error and can anyone tell me how to fix this?
After this error being displayd every access to the server is blocked from 10 to 15 minutes?
The client have full access to server so that is not the problem.
It is standard LAMP environment.
Thanks!
Related
The mod_security configuration in Apache, on the CWP7.admin, generates a 403 access denied error when running Grav CMS:
[Thu Mar 21 15:40:47.967502 2019] [:error] [pid 21727:tid 140715786946304] [client 186.67.206.59:57900] [client 186.67.206.59] ModSecurity: Access denied with code 403 (phase 2). Pattern match "([\\~\\!\\#\\#\\$\\%\\^\\&\\*\\(\\)\\-\\+\\=\\{\\}\\[\\]\\|\\:\\;\"\\'\\\xc2\xb4\\\xe2\x80\x99\\\xe2\x80\x98\\`\\<\\>].*?){8,}" at REQUEST_COOKIES:grav-tabs-state. [file "/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "157"] [id "981172"] [rev "2"] [msg "Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded"] [data "Matched Data: \x22 found within REQUEST_COOKIES:grav-tabs-state: {\x22tab-content.options.advanced\x22:\x22data.content\x22,\x22tab-content.options\x22:\x22data.content\x22,\x22tab-content.options.advanced.blog\x22:\x22data.options\x22}"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [hostname "xxxxxxxx.com"] [uri "/favicon.ico"] [unique_id "XJOwf0cQATwA6mgjE8O7AwAAANc"], referer: http://xxxxxxxx.com/
This error only happens when visiting the website a second time, making it very hard to solve.
Upon inspecting the logs, I found the same pattern of errors for Grav CMS based sites generated by mod_security. This answer by Barry Pollard guided my solution
The error noted the mod_security rule blocking my request:
/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
the corresponding line
[line "157"]
And its ID
[id "981172"]
Using the advice from Barry , I added the following line after the rule:
SecRuleUpdateTargetById 981172 !REQUEST_COOKIES:grav-tabs-state
In this case I'm asking mod_security to omit REQUEST_COOKIES:grav-tabs-state from the rule 981172. This solved the issue.
Thanks from the bottom of my heart to #barrypollard
i ve a strange problem
i install prestashop library on symfony (iq2i/prestashop-webservice-bundle)
i can connect to two internet websites (one is http the other https)
but on the third i got the error:
{"message":"This call to PrestaShop Web Services returned an unexpected HTTP status of:403"}
i ve this website install localy too on my computer with the same files as the remote one, and i can connect with symfony to my local website, but nope on the internet one...
i check rights, .htaccess ...
so i enable the debug and i got:
You don't have permission to access /api/products
an idea please ?
if you have got the error:
[Fri Jun 15 16:28:52 2018] [error] [client 157.108.59.137] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/usr/local/apache2/conf/modsecurity/base_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "65"] [id "960009"] [rev "2.1.1"] [msg "Request Missing a User Agent Header"] [severity "NOTICE"] [tag "PROTOCOL_VIOLATION/MISSING_HEADER_UA"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
with OVH provider
on the root folder, you ve got a filename .ovhconfig
you have to add the following line:
modsecurity == WAF === http.firewall=security
my server return 405, Method Not Allowed when request to https with http_method DELETE, but request to http is ok. Can anyone please help ?
Server Environment
Apache 2.4.29
DirectAdmin 1.52.1
OS: centOS release 6.9 (Final)
Thanks
Add Error log
[Wed Jan 03 11:57:38.331926 2018] [allowmethods:error] [pid 8569] [client 171.97.62.152:59633] AH01623: client method denied by server configuration: 'DELETE' to /home/------/domains/------.com/private_html/
The sure way to fix this is to learn why Apache denies the requests in your particular case. You can learn this from its error logs.
In my case, tail -f /usr/local/apache/logs/error_log
gave this:
[Tue 2 08:39:52.570672 2018] [:error] [pid 32076:tid 140086307448576]
[client 93.125.93.77] ModSecurity: Access denied with code 501 (phase 2).
Match of "rx ^((?:(?:POS|GE)T|OPTIONS|HEAD))$" against "REQUEST_METHOD"
required. [file "/usr/local/apache/conf/modsec-imh/01_base_rules.conf"] [line
"32"] [id "960032"] [msg "Method is not allowed by policy"] [severity
"CRITICAL"] [tag "POLICY/METHOD_NOT_ALLOWED"] [hostname "104.244.122.237"]
[uri "/products/order/items/45"] [unique_id "V96LGGj0eu0AAH1MR8sAAACB"]
It mentions a security rule and the file it's coming from:
/usr/local/apache/conf/modsec-imh/01_base_rules.conf. Editing that file solved my problem smoothly.
I have a cPanel server with apache 2.4 and Maldetect, ClamAV. I want to have realtime malware scanner on server to block hackers from uploading malicious files on server. What i meant is when someone uploads a file, apache will invoke the scanner using mod-security 2.9 and scan the uploaded file.
If it's found as malware - should get rejected.
If it's found good file - should upload to correct destination.
I have tried to do this with following settings as described in https://www.rfxn.com/appdocs/README.maldetect
To enable upload scanning with mod_security2 you must set enable the public_scan option
in conf.maldet (public_scan=1) then add the following rules to your mod_security2
configuration. These rules are best placed in your modsec2.user.conf file on cpanel servers
or at the top of the appropraite rules file for your setup.
/usr/local/apache/conf/modsec2.user.conf (or similar mod_security2 rules file):
SecRequestBodyAccess On
SecRule FILES_TMPNAMES "#inspectFile /usr/local/maldetect/hookscan.sh" \
"id:'999999',log,auditlog,deny,severity:2,phase:2,t:none"
If using ModSecurity >=2.9, you should set 'SecTmpSaveUploadedFiles On' before the
'SecRule FILES_TMPNAMES' line.
A restart of the Apache service is required following these changes.
But the problem is all the files are getting rejected by doing this, even good files. Is there anything wrong with the above setup?
# cat /usr/local/apache/conf/modsec2.user.conf
### UPLOAD PARAMETERS BEGIN ####
SecUploadDir /tmp
SecTmpDir /tmp/
SecDataDir /tmp/
SecUploadKeepFiles RelevantOnly
### UPLOAD PARAMETERS END ####
SecRequestBodyAccess On
SecTmpSaveUploadedFiles On
SecRule FILES_TMPNAMES "#inspectFile /usr/local/maldetect/hookscan.sh" \
"id:'999999',log,auditlog,deny,severity:2,phase:2,t:none"
Following is the error in logs
[Sun Mar 05 21:11:35.936553 2017] [:error] [pid 9800] [client x.x.x.x] ModSecurity: Access denied with code 406 (phase 2). File "/tmp/20170305-211135-WLxNz#kP#rKcABIc7ZF3lAAAAAM-file-SfujtQ" rejected by the approver script "/usr/local/maldetect/hookscan.sh": Linux Malware Detect v1.5 [file "/usr/local/apache/conf/modsec2.user.conf"] [line "13"] [id "999999"] [severity "CRITICAL"] [hostname "x.x.x.x"] [uri "/test.php"] [unique_id "WLxNz#kP#rKcABIc7ZF3lAAAAAM"]
[Sun Mar 05 21:11:44.511418 2017] [:error] [pid 9526] [client x.x.x.x] ModSecurity: Access denied with code 406 (phase 2). File "/tmp/20170305-211144-WLxN2EJsvK1FL3paCDmxrgAAAAE-file-iQx2zR" rejected by the approver script "/usr/local/maldetect/hookscan.sh": Linux Malware Detect v1.5 [file "/usr/local/apache/conf/modsec2.user.conf"] [line "13"] [id "999999"] [severity "CRITICAL"] [hostname "x.x.x.x"] [uri "/test.php"] [unique_id "WLxN2EJsvK1FL3paCDmxrgAAAAE"]
I had this issue too. Problem is this line:
SecTmpSaveUploadedFiles On
Try to remove it from the rule.
I could use some advice on whitelisting JSON ARGS_NAMES that modsecurity seems to complain about. I'm not sure how to properly specify the ARGS_NAMES for a JSON Request. My app uses JSON heavily, so there are a few of these alerts for different style requests.
The following alert is triggered by a POST request (sign-in/authentication) to my backend application:
2015-08-06T23:02:21.09022 [Thu Aug 06 23:02:21.090206 2015] [:error] [pid > 18099:tid 140155981653760] [client 192.168.216.16] ModSecurity: Warning. > Pattern match "(?i:(?:union\\s*?(?:all|distinct|[(!#]?)?\\s?[([]? \\s?select\\s+)|(?:\\w+\\s+like\\s+> [\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98])|(?:like\\\\s*? [\\"'\xc2\xb4\xe2\x80\x99\xe2\x80\x98]\\%)|(?: [\"'\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98]\\\\s*?like\\\\W*? [\\"'\xc2\xb4 ..." at ARGS_NAMES: {"username":"userid2","password":"blahblah"}. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "223"] [id "981245"] [msg "Detects basic SQL authentication bypass attempts 2/3"] [data "Matched Data: \x22:\x22userid2\x22,\x22p found within ARGS_NAMES: {\x22username\x22:\x22userid2\x22,\x22password\x22:\x22blahblah\x22 }:{\x22username\x22:\x22userid2\x22,\x22password\x22:\x22blahblah\x22 }"] [severity "CRITICAL"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"][hostname "api.host.name"] [uri "/user-api/auth-service"] [unique_id "VcPnfQobAhEAAEazjWUAAABB"]
Here's another alert triggered by an AJAX update to a user's session data:
2015-07-22T22:02:03.61377 [Wed Jul 22 22:02:03.613737 2015] [:error] [pid > 14702:tid 140281273739008] [client 10.72.2.5] ModSecurity: Access denied > with code 403 (phase 2). Pattern match "(.*)" at TX:981257-Detects MySQL > comment-/space-obfuscated injections and backtick termination- OWASP_CRS/WEB_ATTACK/SQLI-ARGS_NAMES:{"data":{"categories": [{"uuid":"10009","name":"Books","folder":"School"}],"category_ids": ["188"],"transaction_ids":["ed529b9f47ee-ab23-5b98-4404-d59a86b9","ed529b9f47ee-ab23-5b98-4404-d59a86b9","ed529b9f47ee-ab23-5b98-4404-d59a86b9"]}}. [file "/etc/apache2/modsecurity-crs/activated_rules/modsecurity_crs_49_inbound_blocking.conf"] [line "26"][id "981176"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20, SQLi=4, XSS=0): Last Matched Message: 981243-Detects classic SQL injection probings 2/2"] [data "Last Matched Data: ,\x22name\x22:"] [hostname "host.name.com"] [uri "/new/data"] [unique_id "VbAS2wobA80AADluSjYAAADw"]
How can I create a whitelist for "ARGS_NAMES:{"username[..]" or "ARGS_NAMES:{data[..]"? When I try to whitelist with regex, I wind up with a rule like this:
SecRule ARGS_NAMES:"({\"(data)\":)(({\"[a-z_]+\":).)" "(.)" "id:308,phase:2,t:none,nolog,pass,ctl:ruleRemoveTargetByTag=.;ARGS_NAMES:({\"(data)\":)(({\"[a-z_]+\":).)"
I believe this works unless PCRE limits exceeded, from testing. Is there an easier way to do this for JSON arguments?
Here's another method I tried in an earlier iteration of my whitelists:
SecRule ARGS:data.transaction_ids "(([a-z0-9-]))" "id:206,phase:2,nolog,pass,ctl:ruleRemoveTargetByTag=.;ARGS:data.transaction_ids,ctl:ruleRemoveTargetById=960024;ARGS:data.transaction_ids"
To the best of my knowledge this works, but I want to be able to whitelist any request that uses the "{data:" JSON format within the request body. I want to verify the correct method of whitelisting JSON arguments before I go in for another round of testing.
What am I missing here?