ModSecurity is an open source web application firewall. Working embedded in the web server, or standalone as a network appliance, it detects and prevents attacks against web applications. ModSecurity is most often embedded with the Apache webserver to block malicious requests. But recently I found an annoying false positive block with ModSecurity. The error is like this:
Access denied with code 403 (phase 2). Match of "rx ://%{SERVER_NAME}/" against "ARGS:review[]" required. [file "/usr/local/apache/conf/modsec2/10_asl_rules.conf"] [line "497"] [id "340162"] [rev "287"] [msg "Atomicorp.com UNSUPPORTED DELAYED Rules: Remote File Injection attempt in ARGS (AE)"] [data "http://www.ivankristianto.com/save-your-gmail-inbox-space-by-delete-old-attachments/"] [severity "CRITICAL"]I created a test case that you can try here: if you submit a URL with http:// then you will get an error of 403: Forbidden. But if you submit a URL without http:// then it will work.
Until now I cannot solve this without turning off ModSecurity, which I won’t. The only workaround is to remove the http:// via JavaScript when submitted.
If you know how, please let me know in the comment form below. Thanks.