OK. I haven’t written long time on blog. Today I want to show you what sometimes
yum can do without your knowledge. Few days ago I was upgrading one of system using yum.
Everything looked fine. I was happy that sometimes yum is useful. After work I went sleep
and next day I received messages that smth is fu** up with www…
… yep and the real history is starting now 
After update nobody can log into wordpress. When you go to site you saw only text and all design was not loaded. In logs I saw message 403 – Access Denied. Hm… but yesterday everything was working good. WTF? Someone compromised my box? Change the permission? Hm… let’s look… Hm… permission is good so why I have 403 message? Let’s look for rootkits After few hours I was almost sure that box was clean!
Let’s check another test. I was creating directory ‘wp-content’ on random site and put some random file. When I send request for this file i received 403 message once again. When I moved file to upper directory – everything worked fine Strange Let’s look for logs once again… What I saw? Look:
–c28ca12d-B–
GET /wp-content/themes/gods-and-monsters/style.css HTTP/1.1
…
…
–c28ca12d-F–
HTTP/1.1 403 Forbidden
Content-Length: 311
Connection: close
Content-Type: text/html; charset=iso-8859-1
–c28ca12d-H–
Message: Pattern match “([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z_@>\|])(\s*return\s*)?(?:globalstorage|sessionstorage|postmessage|callee|constructor|content|domain|prototype|try|catch|top|call|apply|url|function|object|array|string|math|if|elseif|case|switch|regex|boolean|l …” at REQUEST_URI_RAW. [file “/etc/httpd/modsecurity.d/base_rules/modsecurity_crs_41_phpids_filters.conf”] [line “67”] [id “phpids-20”] [msg “Detects JavaScript language constructs”] [data “content/”] [severity “CRITICAL”] [tag “WEB_ATTACK”]
…
…
WTF? “Detects JavaScript language constructs” ? “CRITICAL” ? LOL Let’s look for this strange filter:
-rw-r–r– 1 root root xxK 11-29 xx:xx modsecurity_crs_41_phpids_filters.conf
-rw-r–r– 1 root root xxK 11-29 xx:xx modsecurity_crs_40_generic_attacks.conf
Hm this files was modified when i was upgrading system Line 67 looks like:
SecRule REQUEST_BODY|REQUEST_URI_RAW|XML:/* “([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z_@>\|])(\s*return\s*)?(?:globalstorage|sessionstorage|postmessage|cal
lee|constructor|content|domain|prototype|try|catch|top|call|apply|url|function|object|array|string|math|if|elseif|case|switch|regex|boolean|location|settimeo
ut|setinterval|void|setexpression|namespace|while)(?(1)[^\w%\”]|(?:\s*[^@\s\w%\”,.+\-]))” “phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replace
Comments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,block,nolog,auditlog,msg:’Detects JavaScript language constructs’,id:’phpids-20′,tag:’WEB_ATTA
CK’,logdata:’%{TX.0}’,severity:’2′,setvar:’tx.msg=%{rule.msg}’,setvar:tx.anomaly_score=+20,setvar:tx.%{rule.id}-WEB_ATTACK-%{matched_var_name}=%{matched_var}
”
heh So everything which was in wp-content was blocked by mod_security I removed this line and some other strange (bad access wasn’t causes only by this line) and everything back to normal
Conclusion:
*) I always have been compiling by hand and modifying by hand everything so I always know what I do. When you are using automatic tools you can be surprised
*) I didn’t believe that mod_security could causes this problem so I ignored this logs on first reading – and it causes longer time to discover real problem
*) Automatic tool = faster but you should always check everything before you “Accept” his job
Best regards,
Adam Zabrocki
Comments
Leave a Reply
Borys Łącki on 12.03.2009
Automatic tool = faster but you should always check everything before you “Accept” his job – my favourite :]
Christian Rodriguez on 01.13.2010
Hey there – was setting up wordpress tonight and ran into this same problem. Had me stumped for a few hours before I figured out it was mod_security, and before I specifically tracked it down to this line.
I didn’t remove the entire line; instead I just removed |content| and so far everything is working. I’m definitely suspicious, though, and will keep an eye on this rule and disable it if it becomes a problem.
admin on 01.13.2010
Hi Christian
If you won’t have any problems with your changing mod_security configuration, give me this information
I will check it too…
Best regards,
Adam Zabrocki