ModSecurity: Access denied with code 403

Question

I have enabled mod security for one of my servers how ever if I submit a form with unicode characters it shows the following error in the log and doesn't allow to access the web page.

[Wed May 192.168.0.1 2013] [error] [client 192.168.0.1] ModSecurity: Access denied with code 403 (phase 2). 
Pattern match "(?i:(?:,.*?[)\\\\da-f\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98][\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98](?:[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98].*?[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98]|\\\\Z|[^\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98]+))|(?:\\\\Wselect.+\\\\W*?from)|((? ..." at ARGS:shortDescription. [file "/etc/httpd/modsecurity-crs/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "209"] [id "981257"] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data "Matched Data: , \\xe0\\xb6\\xa1\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a\\xe0\\xb6\\xaf \\xe0\\xb6\\xb6\\xe0\\xb6\\xbd\\xe0\\xb6\\xba\\xe0\\xb7\\x99\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a \\xe0\\xb6\\x91\\xe0\\xb6\\xba \\xe0\\xb6\\xb4\\xe0\\xb7\\x99\\xe0\\xb6\\xbb\\xe0\\xb7\\x85\\xe0\\xb7\\x93\\xe0\\xb6\\xb8\\xe0\\xb6\\xa7 \\xe0\\xb6\\x9a\\xe0\\xb6\\xa7\\xe0\\xb6\\xba\\xe0\\xb7\\x94\\xe0\\xb6\\xad\\xe0\\xb7\\x94 \\xe0\\xb6\\x9a\\xe0\\xb6\\xbb\\xe0\\xb6\\xb1 \\xe0\\xb6\\xb6\\xe0\\xb7\\x80\\xe0\\xb6\\xad\\xe0\\xb7\\x8a \\xe0\\xb7\\x80\\xe0\\xb7\\x92\\xe0\\xb6\\xb4\\xe0\\xb6\\x9a\\xe0\\xb7\\x8a\\xe0\\xb [hostname "doomain.test.invalid"] [uri "/admin/add_news_article.php"] [unique_id "UZycDtHvchoAAENNXfYAAABR"] 

Answer 1

If this site is a producive server: run Mod_Security in detection_only mode first and check the logs for false positives.

Look in the CRS for the ID:

localhost:/etc/modsecurity>grep 981257 *.conf
modsecurity_crs_41_sql_injection_attacks.conf:SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "(?i:(?:,.*?[)\da-f\"'`´’‘][\"'`´’‘](?:[\"'`´’‘].*?[\"'`´’‘]|\Z|[^\"'`´’‘]+))|(?:\Wselect.+\W*?from)|((?:select|create|rename|truncate|load|alter|delete|update|insert|desc)\s*?\(\s*?space\s*?\())" "phase:2,capture,t:none,t:urlDecodeUni,block,msg:'Detects MySQL comment-/space-obfuscated injections and backtick termination',id:'981257',tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',severity:'2',setvar:'tx.msg=%{rule.id}-%{rule.msg}',setvar:tx.sql_injection_score=+1,setvar:tx.anomaly_score=+%{tx.critical_anomaly_score},setvar:'tx.%{tx.msg}-OWASP_CRS/WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}'"

Looks like you have special characters in your argument shortDescription .

Answer 2

Another hint: If you have a rule which provokes a lot of "false positives", you easily can disable it (even specifically for a given path) using the SecRuleRemoveById keyword. Example for the error in your question:

<Directory /var/www/admin>
  SecRuleRemoveById 981257
</Directory>

Assumed /var/www is the DOCUMENT_ROOT used. This way you can use the complete provided ruleset, but disable single rules where they should not be applied.

Answer 3

I was also experiencing the Mod Security error on Apache 2.4.6 (CentOS). I had to turn off Mod Security feature because it was blocking WordPress Authentication and displaying 403 page instead.

Disclaimer: This is just a quick fix. But is not recommended to turn off this feature in a production environment because its basically compromising on security.

That being said, Look for the mod_security.conf file which is found in /etc/httpd/conf.d directory on most Linux environments.

Look for the lines containing SecRuleEngine and SecRequestBodyAccess which are usually Set to On when this feature is in effect. So set them to Off to disable Mod Security. Save the file and restart your server.

This should look like this

SecRuleEngine Off
SecRequestBodyAccess Off