Serious false positive rule 21100

Free Modsecurity rules - Comodo Web Application Fi
#1

Hello Guys!

Lately we have gotten a storm of customers just logged into cPanel and webmail. They cannot change table/rows in phpmyadmin and just reading their webmail get’s them blocked by our csf/firewall because WAF rule 211000 is hitting all websites with cpanel.domain.tld and webmail.domain.tld host.

See webmail here:

For cPanel/phpmyadmin edit:

Could you please fix that rule asap? Or disable WAF on all subdomains for cpanel/webmail?

#2

We will investigate this incident and fix will be available within next update. Thank you for your feedback.

#3

Meanwhile you can add faulty rule to exludes by running CWAF CLI script:

/var/cpanel/cwaf/scripts/cwaf-cli.pl -xa 211000

Regards, Oleg

#4

Any updates on this?

Getting more and more customers getting blocked because of this and they cannot do much inside cPanel!

See new screenshot here:

#5

This is something that needs to be fixed asap.
Please get a fix for this. We have not had problems with this before so it has to be with the latest rules updates.

#6

Should be fixed by update.

#7

The latest update by agent/rule that was released today?

#8

Yes, it should help.

#9

Well, we still got serious issues when customer is updating/deleting a row in phpmyadmin inside cPanel:
Request: POST /cpsess9710167270/3rdparty/phpMyAdmin/import.php
Action Description: Access denied with code 403 (phase 2).
Justification: Pattern match “(?:\b(?:c(?:d(?:\b[^a-zA-Z0-9_]{0,}?[/\]|[^a-zA-Z0-9_]{0,}?\.\.)|hmod.{0,40}?\+.{0,3}x|md(?:\b[^a-zA-Z0-9_]{0,}?/c|(?:\.exe|32)\b))|(?:echo\b[^a-zA-Z0-9_]{0,}?\by{1,}|n(?:et(?:\b[^a-zA-Z0-9_]{1,}?\blocalgroup|\.exe)|(?:c|map)\.exe)|t(?:c …” at ARGS:sql_query.

We really need this fixed!

#10

Hi

This is other rule: 211210
We can try to disable it for phpMyAdmin import only.
Please add this to you mod_security configuration (in Plugin open ‘Userdata’ - ‘Custom Rules’, or in console edit /etc/cwaf/httpd/custom_user.conf)

<LocationMatch "/3rdparty/phpMyAdmin/import.php$"> 
 SecRuleRemoveById 211210
</LocationMatch>

Regards, Oleg

#11

Can’t you whitelist all subdomains like webmail, cpanel ?
Will you fix this on that rule in the next update?

#12

Hi

I think weakening of security have to be conscious act of certain user :P0l
I will ask rule writers if it possible to fix this rule somehow not reducing overall rules security.

Regards, Oleg

#13

Could they fix this?

We still have brand new customers contacting us about this issue. It’s causing us to loose customers. See screenshot:
http://imgur.com/sRWhQpi

#14

Will be fixed in next update.

#15

Still not fixed!
Do you know when this will be fixed? We use the latest rules also.
Take a look:
http://imgur.com/vcm0yGX

#16

It seems to be a real attack.
If you suppose that it’s false-positive just exclude this rule.

#17

No it’s not real!
We are trying to edit .htaccess trough file manager inside cPanel.

As I said before your rules should not act against something done within cpanel, webmail etc subdomains.
If someone get’s access there this rule is not enough to stop a hacker.

#18

I suppose you can use directive for some directories you need and turn ModSecurity off for them, but it works as I know for Apache only.