ModSecurity 3 prevents ACP

[thecoalman]

Depends, the rule set can be customized or even paid for. However the common one is provided by OWASP, no idea how many rulesthey have but there is hundreds or thousands of them. Each rule is assigned an anomaly value based on the threat, you could trigger multiple rules. If the total anomaly value goes over the threshold the action is blocked.

Based on the many recent topics here about this I would guess they probably added or changed a rule that is giving the false positives. No one has posted the rule being triggered so it's impossible to determine what the issue may be. The rule being triggeed may be listed in your server error logs. Post the entire line(s).

[5hocK]

error_log is empty.
My host says

We whitelisted a mod_sec PID which is causing the issue. If you still have the problem we can whitelist the ModSecurity ID causing the issue, but we need the exact steps to replicate the error from our side.

But made no difference. I've gave them login details.

[5hocK]

My host say they found the error and disabled the rule. I have access again.

Error
[Mon Mar 04 14:19:50.044831 2024] [security2:error] [pid 12796:tid 47477742208768] [client 74.81.95.50:35422] [client 74.81.95.50] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/index.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/001_i360_basic.conf"] [line "8"] [id "77350314"] [msg "IM360 WAF: Path traversal attack||User:jsofzone||Path:/adm/index.php||Arg:ARGS:redirect||Match:../adm/index.php?sid=6ca476c56b10f276981ef14fabb984a2||T:APACHE||"] [severity "CRITICAL"] [tag "service_im360"] [hostname "www.example.org"] [uri "/adm/index.php"] [unique_id "ZeYe1nrqthuUh2uffMcgEAAAAQ0"], referer: https://www.example.org/adm/index.php?sid=6ca476c56b10f276981ef14fabb984a2

[ssl]

It's not that they can't change it, they probably don't want to.

Yes I know
This host lost credibility when I learned about this.

[ukautoforums]

My host say they found the error and disabled the rule. I have access again.

Error
[Mon Mar 04 14:19:50.044831 2024] [security2:error] [pid 12796:tid 47477742208768] [client 74.81.95.50:35422] [client 74.81.95.50] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/index.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache/001_i360_basic.conf"] [line "8"] [id "77350314"] [msg "IM360 WAF: Path traversal attack||User:jsofzone||Path:/adm/index.php||Arg:ARGS:redirect||Match:../adm/index.php?sid=6ca476c56b10f276981ef14fabb984a2||T:APACHE||"] [severity "CRITICAL"] [tag "service_im360"] [hostname "www.example.org"] [uri "/adm/index.php"] [unique_id "ZeYe1nrqthuUh2uffMcgEAAAAQ0"], referer: https://www.example.org/adm/index.php?sid=6ca476c56b10f276981ef14fabb984a2

Hopefully the phpbb developers can use this error and patch in a future version since it now seems to be a common issue.

I have no idea on modsecurity but that looks to me that the redirect to the admin panel has triggered the block.

[marc3]

Hi,

You can (temporary) solve the problem editing the code with browser Developer Tools.

Simply change this line:

Captura de pantalla 2024-03-06 a les 11.58.23.png

change "./../" with your domain:

Captura de pantalla 2024-03-06 a les 11.58.41.png

Regards,

[Vauxi]

Mod Security 3 is back online and do not prevent ACP anymore. There were rule that was edited by the host of the host.