Uploaded image for project: 'JBoss Core Services'
  1. JBoss Core Services
  2. JBCS-1192

RHEL9 - mod_security blocks communication to mod_proxy_cluster

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • Critical
    • None
    • None
    • mod_proxy_cluster

    Description

      When mod_security is installed we get the following the log and it prevents any form of communication with mod_proxy_cluster!

      [Wed Sep 01 10:20:11.741498 2021] [:error] [pid 3716:tid 3884] [client 10.0.137.62:34546] [client 10.0.137.62] ModSecurity: Warning. Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "43"] [id "911100"] [msg "Method is not allowed by policy"] [data "INFO"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272/220/274"] [tag "PCI/12.1"] [hostname "10.0.137.62"] [uri "/"] [unique_id "YS-MG6cz_QGO1Q2DlrY6dQAAAEI"]
      [Wed Sep 01 10:20:11.741617 2021] [:error] [pid 3716:tid 3884] [client 10.0.137.62:34546] [client 10.0.137.62] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "10.0.137.62:8747"] [severity "WARNING"] [ver "OWASP_CRS/3.3.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "10.0.137.62"] [uri "/"] [unique_id "YS-MG6cz_QGO1Q2DlrY6dQAAAEI"]
      [Wed Sep 01 10:20:11.741948 2021] [:error] [pid 3716:tid 3884] [client 10.0.137.62:34546] [client 10.0.137.62] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "10.0.137.62"] [uri "/"] [unique_id "YS-MG6cz_QGO1Q2DlrY6dQAAAEI"]
      

      in mod_security2 the default was to allow all, but it look like that has changed.

      Attachments

        Activity

          People

            rhn-engineering-jclere Jean-Frederic Clere
            plodge Paul Lodge
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

              Created:
              Updated: