« previous next »
Pages: 1 [2] 3

Author Topic: :):):) Comodo WAF rules update required :):):)  (Read 1402 times)

0 Members and 2 Guests are viewing this topic.

Offline
Starburst
*****
Re: :):):) Comodo WAF rules update required :):):)
« Reply #15 on: November 15, 2024, 10:22:05 AM »
The Comodo fix was for WooCommerce.

What Rule does WAF show is being triggered by WordPress.

Haven't seen any conflict with Comodo and WordPress on AL8 or AL9.
Logged
Offline
zeejdeej
*
Re: :):):) Comodo WAF rules update required :):):)
« Reply #16 on: November 16, 2024, 02:55:06 AM »
Quote from: Starburst on November 15, 2024, 10:22:05 AM
The Comodo fix was for WooCommerce.

What Rule does WAF show is being triggered by WordPress.

Haven't seen any conflict with Comodo and WordPress on AL8 or AL9.

i am using AlmaLinux 9 with comodo waf rules that you shared i.e. Installed version: 1.241

its blocking all wordpress websites , only main page is opened and if i click on any other link or page on site it blocks, see below logs if you can figure out whats wrong


[Sat Nov 16 03:50:54.257704 2024] [:error] [pid 1330522:tid 1330564] [client 182.183.59.223:64832] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/wp-content/plugins/burst-statistics/endpoint.php"] [unique_id "ZzgIjkgvZjUGsoby_ov1fQAAAIQ"], referer: https://karimsonline.com/
[Sat Nov 16 03:50:54.020822 2024] [:error] [pid 1330522:tid 1330563] [client 182.183.59.223:64832] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/"] [unique_id "ZzgIjkgvZjUGsoby_ov1fAAAAIM"], referer: https://karimsonline.com/
[Sat Nov 16 03:50:52.725801 2024] [:error] [pid 1330522:tid 1330562] [client 182.183.59.223:64832] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/"] [unique_id "ZzgIjEgvZjUGsoby_ov1ewAAAII"], referer: https://karimsonline.com/
[Sat Nov 16 03:50:46.468741 2024] [:error] [pid 1330502:tid 1330505] [client 182.183.59.223:64830] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/blog/"] [unique_id "ZzgIhpCaZKKW28uOR-L7sQAAAAA"]
[Sat Nov 16 03:48:36.874131 2024] [:error] [pid 1330019:tid 1330074] [client 182.183.59.223:64816] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/wp-content/plugins/burst-statistics/endpoint.php"] [unique_id "ZzgIBLel4_HzjjsBKm1tKwAAAIo"], referer: https://karimsonline.com/
[Sat Nov 16 03:48:36.672057 2024] [:error] [pid 1330019:tid 1330064] [client 182.183.59.223:64816] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/blog/"] [unique_id "ZzgIBLel4_HzjjsBKm1tKgAAAIA"], referer: https://karimsonline.com/
[Sat Nov 16 03:48:35.337429 2024] [:error] [pid 1330095:tid 1330097] [client 182.183.59.223:64812] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/wp-content/uploads/2024/07/WhatsApp-Video-2024-07-03-at-1.45.39-PM.mp4"] [unique_id "ZzgIA_A-4WHASGySwtqn9gAAAMA"], referer: https://karimsonline.com/
[Sat Nov 16 03:48:34.872764 2024] [:error] [pid 1330019:tid 1330072] [client 182.183.59.223:64816] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/wp-content/uploads/elementor/css/post-8371.css"] [unique_id "ZzgIArel4_HzjjsBKm1tKQAAAIg"], referer: https://karimsonline.com/
[Sat Nov 16 03:48:34.846642 2024] [:error] [pid 1330095:tid 1330120] [client 182.183.59.223:64812] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/"] [unique_id "ZzgIAvA-4WHASGySwtqn9QAAANc"], referer: https://karimsonline.com/
[Sat Nov 16 03:48:34.698242 2024] [:error] [pid 1330007:tid 1330042] [client 182.183.59.223:64811] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/wp-includes/images/w-logo-blue-white-bg.png"] [unique_id "ZzgIAnBkV9IysqCAxkWtOgAAAEk"], referer: https://karimsonline.com/
[Sat Nov 16 03:48:34.632827 2024] [:error] [pid 1330095:tid 1330119] [client 182.183.59.223:64803] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/favicon.ico"] [unique_id "ZzgIAvA-4WHASGySwtqn9AAAANY"], referer: https://karimsonline.com/
[Sat Nov 16 03:48:34.406136 2024] [:error] [pid 1330095:tid 1330113] [client 182.183.59.223:64803] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "[\\\\[\\\\]\\\\x22',()\\\\.]{10}$|\\\\b(?:union\\\\sall\\\\sselect\\\\s(?:(?:null|\\\\d+),?)+|order\\\\sby\\\\s\\\\d{1,4}|(?:and|or)\\\\s\\\\d{4}=\\\\d{4}|waitfor\\\\sdelay\\\\s'\\\\d+:\\\\d+:\\\\d+'|(?:select|and|or)\\\\s(?:(?:pg_)?sleep\\\\(\\\\d+\\\\)|\\\\d+\\\\s?=\\\\s?(?:dbms_pipe\\\\.receive_message\\\\ ..." at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-cwaf/rules/22_SQL_SQLi.conf"] [line "66"] [id "218500"] [rev "18"] [msg "COMODO WAF: SQLmap attack detected||karimsonline.com|F|2"] [data "Matched Data: |||rf=(none) found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:33|||ep=https:/karimsonline.com/|||rf=(none)"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "karimsonline.com"] [uri "/wp-content/plugins/burst-statistics/endpoint.php"] [unique_id "ZzgIAvA-4WHASGySwtqn8wAAANA"], referer: https://karimsonline.com/
Logged
Offline
zeejdeej
*
Re: :):):) Comodo WAF rules update required :):):)
« Reply #17 on: November 16, 2024, 03:11:50 AM »
[Sat Nov 16 04:08:49.493070 2024] [:error] [pid 1333365:tid 1333386] [client 182.183.59.223:63036] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(\\\\!\\\\=|\\\\&\\\\&|\\\\|\\\\||>>|<<|>=|<=|<>|<=>|xor|rlike|regexp|isnull)|(?:not\\\\s+between\\\\s+0\\\\s+and)|(?:is\\\\s+null)|(like\\\\s+null)|(?:(?:^|\\\\W)in[+\\\\s]*\\\\([\\\\s\\\\d\\"]+[^()]*\\\\))|(?:xor|<>|rlike(?:\\\\s+binary)?)|(?:regexp\\\\s+binary))" at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "70"] [id "981319"] [rev "2"] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: || found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:21|||ep=https://fizascollection.co.uk/|||rf=(none)"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "fizascollection.co.uk"] [uri "/favicon.ico"] [unique_id "ZzgMwaSdHEb44HSsRSRFyAAAAEA"], referer: https://fizascollection.co.uk/
[Sat Nov 16 04:08:48.967452 2024] [:error] [pid 1333365:tid 1333390] [client 182.183.59.223:63036] [client 182.183.59.223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(\\\\!\\\\=|\\\\&\\\\&|\\\\|\\\\||>>|<<|>=|<=|<>|<=>|xor|rlike|regexp|isnull)|(?:not\\\\s+between\\\\s+0\\\\s+and)|(?:is\\\\s+null)|(like\\\\s+null)|(?:(?:^|\\\\W)in[+\\\\s]*\\\\([\\\\s\\\\d\\"]+[^()]*\\\\))|(?:xor|<>|rlike(?:\\\\s+binary)?)|(?:regexp\\\\s+binary))" at REQUEST_COOKIES:sbjs_current_add. [file "/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "70"] [id "981319"] [rev "2"] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: || found within REQUEST_COOKIES:sbjs_current_add: fd=2024-11-16 02:48:21|||ep=https://fizascollection.co.uk/|||rf=(none)"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "fizascollection.co.uk"] [uri "/"] [unique_id "ZzgMwKSdHEb44HSsRSRFxwAAAEI"]
Logged
Offline
Starburst
*****
Re: :):):) Comodo WAF rules update required :):):)
« Reply #18 on: November 16, 2024, 02:32:44 PM »
The problem looks like a WordPress plugin called Burst Statistics.

Disable that plugin, and see if the error goes away.
Programmers sometime use malicious code in valid programs, which can give 'false positives'.

If the error goes away, maybe check out MonsterInsights instead.

Only other option would be to disable the rule being triggered - 22_SQL_SQLi.conf

But I never recommend doing that, because it could leave the system open to attack.
Logged
Offline
cyberspace
***
Re: :):):) Comodo WAF rules update required :):):)
« Reply #19 on: November 16, 2024, 04:36:31 PM »
Try to disable the mod_security rule 218500 by adding the following lines into .htaccess located in the document root of the website(s):

Code: [Select]
<IfModule mod_security2.c>
    SecRuleRemoveById 218500
</IfModule>

OR

If you want to disable the rule globally (for all websites) then put the line:
Code: [Select]
SecRuleRemoveById 218500into the file:

/usr/local/apache/modsecurity-owasp-old/global_disabled_rules.conf

and then restart Apache/HTTPD.
Logged
Offline
zeejdeej
*
Re: :):):) Comodo WAF rules update required :):):)
« Reply #20 on: November 16, 2024, 06:29:50 PM »
yes it worked after disabling SecRuleRemoveById 218500 but comodo waf rules keep switching back to 1.240 after a while automatically. i do update to 1.241 and it showed for a while but revert back to 1.240 
Logged
Offline
cyberspace
***
Re: :):):) Comodo WAF rules update required :):):)
« Reply #21 on: November 16, 2024, 07:18:58 PM »
When does it happen ? After the CWP update or some other action ?

As a test update the rules, then run cwp update:
Code: [Select]
/scripts/update_cwpand then check if the rules version stay intact.
Logged
Offline
Starburst
*****
Re: :):):) Comodo WAF rules update required :):):)
« Reply #22 on: November 17, 2024, 12:49:01 AM »
The ruleset version should stay the same unless you are switching back & forth between Comodo and OWASP.

ID 218500 was a bug between 1.240 with WooCommerce.
Burst Statistics must use some of the same buggy code then.
Logged
Offline
zeejdeej
*
Re: :):):) Comodo WAF rules update required :):):)
« Reply #23 on: January 24, 2025, 01:37:53 PM »
why comodo waf rules are not updated automatically in CWP Pro like it was updating before. since long its not updated?
Logged
Offline
Starburst
*****
Re: :):):) Comodo WAF rules update required :):):)
« Reply #24 on: January 24, 2025, 11:50:49 PM »
The Comodo ruleset isn't a CWP problem.

I can't login with my UN/PW on their site for months now - waf.comodo.com
Seems like the new company who took them over want you to buy their ruleset.

They also haven't responded to emails.

So at this point I'm saying that ruleset is dead, thanks to another takeover.
Logged
Offline
Netino
***
Re: :):):) Comodo WAF rules update required :):):)
« Reply #25 on: January 25, 2025, 03:17:58 AM »
I agree that it is dead. But the problem with Comodo being dead is that it forces most of us who use free rulesets to migrate to the only known free alternative, which is the OWASP rules.
And that certainly can't be done overnight.
And whoever wants to take on this challenge will have to do some digital juggling to get both rulesets working, putting OWASP in a log-only (no blocks) state while collecting logs and statistics to include its whitelists.
It's a medium-term problem, but it's a very serious problem, and must be worked since now.
Logged
Offline
Starburst
*****
Re: :):):) Comodo WAF rules update required :):):)
« Reply #26 on: January 26, 2025, 12:51:18 AM »
I tried that juggling, and it didn't work.

There is a problem with the OWASP latest ruleset that I've notified CWP about.

I've only found 2 semi-good replacements, but both are paid:

https://malware.expert/

https://atomicorp.com/modsecurity-rules/

And then there is course the company who bought Comodo, Xcitium. But their website doesn't even work
Logged
Offline
Starburst
*****
Re: :):):) Comodo WAF rules update required :):):)
« Reply #27 on: January 26, 2025, 12:53:00 AM »
Quote from: zeejdeej on November 15, 2024, 10:06:32 AM
i switched back to OWASP latest rules but they are not blocking malicious attempts . i can see in logs its detecting but attempt is not blocked  :-[

on the other hand comodo waf rules keeps blocking everything  :-\ before last update everything was fine and comodo waf rules were the best

Yea, there is a bug CWP has been made aware of with the OWASP latest not working.
Logged
Offline
Netino
***
Re: :):):) Comodo WAF rules update required :):):)
« Reply #28 on: January 26, 2025, 04:50:54 PM »
Quote from: Starburst on January 26, 2025, 12:53:00 AM
Quote from: zeejdeej on November 15, 2024, 10:06:32 AM
i switched back to OWASP latest rules but they are not blocking malicious attempts . i can see in logs its detecting but attempt is not blocked  :-[

on the other hand comodo waf rules keeps blocking everything  :-\ before last update everything was fine and comodo waf rules were the best

Yea, there is a bug CWP has been made aware of with the OWASP latest not working.

To avoid this, you can use the OWASP ruleset in "Anomaly Scoring Mode". Instead of blocking each rule individually, as is done in Comodo, a set of rules is evaluated and, if it reaches a certain score, only then is it blocked. This is a very powerful way of blocking. Even so, you should always analyze the ruleset, starting at level 1, the most secure in terms of no false positives, and increasing the level as you add whitelists.
There are plugins for phpMyAdmin, Roundcube and Wordpress, but they need to be tested and adapted for each case. However, it is much less work than building the exceptions from scratch.

From OWASP page:
Code: [Select]
https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.3/dev/crs-setup.conf.example
"
The CRS can run in two modes:
#
# -- [[ Anomaly Scoring Mode (default) ]] --
# In CRS3, anomaly mode is the default and recommended mode, since it gives the
# most accurate log information and offers the most flexibility in setting your
# blocking policies. It is also called "collaborative detection mode".
# In this mode, each matching rule increases an 'anomaly score'.
# At the conclusion of the inbound rules, and again at the conclusion of the
# outbound rules, the anomaly score is checked, and the blocking evaluation
# rules apply a disruptive action, by default returning an error 403.
#
# -- [[ Self-Contained Mode ]] --
# In this mode, rules apply an action instantly. This was the CRS2 default.
# It can lower resource usage, at the cost of less flexibility in blocking policy
# and less informative audit logs (only the first detected threat is logged).
# Rules inherit the disruptive action that you specify (i.e. deny, drop, etc).
# The first rule that matches will execute this action. In most cases this will
# cause evaluation to stop after the first rule has matched, similar to how many
# IDSs function.
"
Logged
Offline
Netino
***
Re: :):):) Comodo WAF rules update required :):):)
« Reply #29 on: January 26, 2025, 04:55:45 PM »
Quote from: Starburst on January 26, 2025, 12:51:18 AM
I tried that juggling, and it didn't work.

There is a problem with the OWASP latest ruleset that I've notified CWP about.

I've only found 2 semi-good replacements, but both are paid:

https://malware.expert/

https://atomicorp.com/modsecurity-rules/

And then there is course the company who bought Comodo, Xcitium. But their website doesn't even work

There is a possibility, for those who use nginx<->*<->Apache.
You can install Comodo on Apache, in normal operation mode, and OWASP on nginx, in log-only mode.
I haven't tested it yet, but it's an idea, and I'll test it very soon.
Logged
Pages: 1 [2] 3
« previous next »