Блог

На платформе общего хостинга, запускающей сайт WordPress с включенными комментариями, некоторые комментарии вызывают 500 ошибок. Файл error.log сервера содержит записи, похожие на эту (некоторые путаницы в пути и IP-адресе, а также разрывы строк, добавленные для визуальной ясности):

      [Thu Aug 12 13:38:35.782008 2021] [:error] [pid 24207:tid 3383178114816] 
[client 24.113.161.xxx:59792] [client xx.xx.xx.x] ModSecurity: Warning. 
    Pattern match "(?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)
\\s (?:\\/|\\w)[^\\s]*(?:\\s http\\/\\d|[\\r\\n])" 
    at REQUEST_BODY. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "52"] [id "921110"] 
    [msg "HTTP Request Smuggling Attack"] 
    [data "Matched Data: post request.\x0d found within REQUEST_BODY: comment=@nick - the error logs indicate that there is some hex characters embedded in the text that causes the 500 error. you may not be able to see the hex characters, 
    but they are recognized as a code injection attempt, which is why the server blocks them (via the mod_sec3_crs module, which interprets the pattern as being a security risk, and therefore blocks the request, which is returned as a 500 error).
    \x0d\x0a\x0d\x0athe embedded characters..."] 
    [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] 
    [tag "paranoia- [hostname "www.ttgnet.com"] 
    [uri "/journal/wp-comments-post.php"] [unique_id "YRWGy9SRhtRZmIT81gkAvAAAAA8"], referer: https://example.com/journal/
 

Аналогичные записи в журнале ошибок также фиксируют шестнадцатеричные значения для CR/LF как нарушения правил. Не все сообщения комментариев вызывают ошибку 500 (или записи в журнале ошибок сервера), но все ошибки, по-видимому, включают шестнадцатеричный шаблон CR/LF в сообщение об ошибке.

Я не очень хорошо разбираюсь в том, как работает mod-sec. С чего мне следует начать диагностику?

Добавлен

Вот пример полной строки из файла журнала с анонимизированными именами папок:

 Line 49: [Tue Sep 21 14:16:06.979253 2021] [:error] [pid 21757:tid 3479988672256] [client 38.13.110.xxx:60982] [client 38.13.110.xxx] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'son;n' [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "65"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: son;n found within ARGS:comment: \x22Put the MP3 files in a zip archive, with a password, put the file in Dropbox, email the link in one email, password in a separate email. No postage involved. \x22\x0d\x0a\x0d\x0aamp;nbsp;\x0d\x0a\x0d\x0aI can do that.\xc2\xa0 A password protected folder on my website.\xc2\xa0 Great idea Ray!!!\x0d\x0a\x0d\x0aamp;nbsp;"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "www.example.com"] [uri "/folder/wp-comments-post.php"] [unique_id "YUpLllhFado5xTTGY0P7wwAAAA8"], referer: https://www.example.com/journal/post-title/
 

Это комментарий к сообщению WordPress от известного комментатора. Стандартное поле для ввода комментариев.

Почему это может быть заблокировано — и вызвать ошибку 500?

добавлен

Вот еще одна ошибка из журнала ошибок сервера. Обратите внимание, что отправитель не хакер (я знаю этого человека); просто комментатор на сайте.

 [Thu Sep 23 11:43:42.440238 2021] [:error] [pid 8853:tid 3479955101440] [client 75.53.225.xxx:56406] [client 75.53.225.xxx] ModSecurity: Warning. Pattern match "(?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)\\s (?:\\/|\\w)[^\\s]*(?:\\s http\\/\\d|[\\r\\n])" at ARGS:comment. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "52"] [id "921110"] [msg "HTTP Request Smuggling Attack"] [data "Matched Data: lock home.\x0d found within ARGS:comment: it's the people.\xc2\xa0 the un isn't forcing them to be dirty.\xc2\xa0 the clinton's removed people from the island, which should have helped (yeah, poor taste).\x0d\x0a\x0d\x0a\xa0\x0d\x0a\x0d\x0aif they don't want to live in garbage under a bridge stay the flock home.\x0d\x0a\x0d\x0a\xa0\x0d\x0a\x0d\x0an"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272/220/33"] [hostname "www.example.com"] [uri "/journal/wp-comments-post.php"] [unique_id "YUzK3shjwDZMxbYxHQ83EQAAAA8"], referer: https://www.example.com/journal/2021/09/23/thur-sept-23-2021-tired-but-the-weather-is-great/

[Thu Sep 23 11:43:42.440563 2021] [:error] [pid 8853:tid 3479955101440] [client 75.53.225.xxx:56406] [client 75.53.225.xxx] ModSecurity: Warning. Pattern match "(?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)\\s (?:\\/|\\w)[^\\s]*(?:\\s http\\/\\d|[\\r\\n])" at REQUEST_BODY. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "52"] [id "921110"] [msg "HTTP Request Smuggling Attack"] [data "Matched Data: lock home.\x0d found within REQUEST_BODY: comment=it's the people.\xc2\xa0 the un isn't forcing them to be dirty.\xc2\xa0 the clinton's removed people from the island, which should have helped (yeah, poor taste).\x0d\x0a\x0d\x0a\xa0\x0d\x0a\x0d\x0aif they don't want to live in garbage under a bridge stay the flock home.\x0d\x0a\x0d\x0a\xa0\x0d\x0a\x0d\x0anamp;author=nick flandreyamp;email=flandrey@aol.comamp;url=https://www.example.com/journal/amp;wp-comment-cookies-consent=yesamp;bcsb_hidden=6f29fb34-6a01..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia- [hostname "www.example.com"] [uri "/journal/wp-comments-post.php"] [unique_id "YUzK3shjwDZMxbYxHQ83EQAAAA8"], referer: https://www.example.com/journal/2021/09/23/thur-sept-23-2021-tired-but-the-weather-is-great/

[Thu Sep 23 11:43:42.458524 2021] [:error] [pid 8853:tid 3479955101440] [client 75.53.225.xxx:56406] [client 75.53.225.xxx] ModSecurity: Access denied with code 418 (phase 2). Operator GE matched 7 at TX:anomaly_score. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.example.com"] [uri "/journal/wp-comments-post.php"] [unique_id "YUzK3shjwDZMxbYxHQ83EQAAAA8"], referer: https://www.example.com/journal/2021/09/23/thur-sept-23-2021-tired-but-the-weather-is-great/
 

Вы уверены, что это действительно не попытки нападения?

Вам, вероятно, потребуется написать правило исключения, вот пример очень простого, которое должно работать:

 SecRule REQUEST_FILENAME "@streq /journal/wp-comments-post.php" 
    "id:9990000,
    phase:1,
    pass,
    t:none,
    nolog,
    ctl:ruleRemoveTargetById=921110;ARGS:comment,
    ctl:ruleRemoveTargetById=921110;REQUEST_BODY"
 

Поместите его в файл ЗАПРОС-900-ПРАВИЛА ИСКЛЮЧЕНИЯ-ДО-CRS.conf .