Page 1 of 1
not getting 403 forbidden when WAF is tripped
Posted: Thu Sep 10, 2015 11:34 am
by imadsani
Hey,
I'm experimenting with a vanilla LAMP server (no control panel). Tripping the WAF is throwing the Apache default page instead of the 403 Forbidden.
I can see the event being logged inside ASL and the IP being block just fine.
Any ideas?
Re: not getting 403 forbidden when WAF is tripped
Posted: Thu Sep 10, 2015 1:50 pm
by mikeshinn
Which rule?
Re: not getting 403 forbidden when WAF is tripped
Posted: Thu Sep 10, 2015 3:39 pm
by imadsani
Code: Select all
340162 Atomicorp.com WAF Rules: URL detected as argument, possible RFI attempt detected
On older ASL versions the above has generated the
403 Forbidden page
Another thing, I tried uninstalling ASL recently but it didn't go well. I couldn't even reinstall ASL, instead had to format the server
Re: not getting 403 forbidden when WAF is tripped
Posted: Thu Sep 10, 2015 4:19 pm
by mikeshinn
I'm not able to reproduce this behavior, the rule specifically sends a 403 error, you can see that in the rule itself:
"phase:2,deny,status:403,capture,id:340162,t:none,t:urlDecodeUni,t:replaceNulls,t:compressWhiteSpace,t:lowercase,chain,rev:300,severity:2,msg:'Atomicorp.com WAF Rules: URL detected as argument, possible RFI attempt detected',logdata:'%TX:0,%{matched_var_name}'"
However, if apache is configured to send something differently, then modsecurity will not over-ride that.
Re: not getting 403 forbidden when WAF is tripped
Posted: Fri Sep 11, 2015 3:14 am
by imadsani
Could you tell me where this is configured inside the apache configuration?
Re: not getting 403 forbidden when WAF is tripped
Posted: Fri Sep 11, 2015 12:53 pm
by mikeshinn
It could be almost anywhere, in a .htaccess file and/or in one or more of your apache configuration file, for example setting custom error responses will do this.