XF 2.1 403 Forbidden When Editing Node Permissions

[thegarfish]

Good afternoon,

I am working on setting up a new forum for a community that I am running but I have ran into the following error when editing permissions to view nodes - note that this is the only time that I have run across this throughout many Xenforo installations.

I am using a VPS that is running Plesk through DigitalOcean.

The error appears when click on the save button after selecting the view node permissions.

As of now I can no longer access my forum following a crash - I was able to fix this previously by running REPAIR TABLE db_xenforo.xf_session but this did not work the second time it crashed following this error.







If anyone has any ideas they would be greatly appreciated.

Thank you,

 

[Paul B]

Contact your host and ask them to whitelist or disable mod sec - that is the most likely cause.

 

[thegarfish]

@Brogan I have seen you say this on nearly 30 threads. Could you provide more information other than that simple one line quip?

 

[Ozzy47]

That’s the solution, what else would you have him say?

 

[thegarfish]

Sorry - didn't mean for it to come off that way. I am searching elsewhere for how to disable mod_sec in relation to Xenforo.

Thank you.

 

[Paul B]

You don't need to disable it completely if you can identify the rules being tripped and whitelist them.

The logs on the server will need to be checked to determine that.

 

[Ozzy47]

It’s something that has to be done on the server level. What type of hosting do you have, shared, VPS or dedi?

 

[thegarfish]

As said in the OP I am running a VPS through DigitalOcean which has a Plesk connection I installed - I can edit Mod_Sec through SSH or Plesk I believe.

 

[Ozzy47]

Then as suggested, check the server logs to determine the offending rule and whitelist it.

 

[thegarfish]

According to the log...

3

[client REDACTED] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:\\\\b(?:t(?:able_name\\\\b|extpos[^a-zA-Z0-9_]{1,}\\\\()|(?:a(?:ll_objects|tt(?:rel|typ)id)|column_(?:id|name)|mb_users|object_(?:id|(?:nam|typ)e)|pg_(?:attribute|class)|rownum|s(?:ubstr(?:ing){0,1}|ys(?:c(?:at|o(?:lumn|nstraint)s)|dba|ibm|(?:filegroup|o ..." at ARGS:type. [file "/etc/apache2/modsecurity.d/rules/comodo_free/22_SQL_SQLi.conf"] [line "17"] [id "211540"] [rev "12"] [msg "COMODO WAF: Blind SQL Injection Attack||mc5star.com|F|2"] [data "Matched Data: user_group found within ARGS:type: user_group"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "mc5star.com"] [uri "/forum/admin.php"] [unique_id "XrCmzVBIv2BjsW3hR5FT5QAAAEI"], referer: https://mc5star.com/forum/admin.php?nodes/staff.3/permissions/edit&user_group_id=3

 

[carsafety]

Developer and I both encountered this same issue today. We were trying to save node permissions for administrative group and it resulted in "Oops! We ran into some problems..." popup error in Xenforo and after a few tries resulted in IP block. I was able to replicate the issue after unblocking my IP. Support also found the same violation of rule 211540 which checks for Blind SQL Injection Attack. They suggest whitelist of rule in .htaccess. Safe to do so, or will this open up Xenforo to an actual malicious attack?

 

[Ozzy47]

Yes, whitelist it.

 

[iCafe]

According to the log...

3

[client REDACTED] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:\\\\b(?:t(?:able_name\\\\b|extpos[^a-zA-Z0-9_]{1,}\\\\()|(?:a(?:ll_objects|tt(?:rel|typ)id)|column_(?:id|name)|mb_users|object_(?:id|(?:nam|typ)e)|pg_(?:attribute|class)|rownum|s(?:ubstr(?:ing){0,1}|ys(?:c(?:at|o(?:lumn|nstraint)s)|dba|ibm|(?:filegroup|o ..." at ARGS:type. [file "/etc/apache2/modsecurity.d/rules/comodo_free/22_SQL_SQLi.conf"] [line "17"] [id "211540"] [rev "12"] [msg "COMODO WAF: Blind SQL Injection Attack||mc5star.com|F|2"] [data "Matched Data: user_group found within ARGS:type: user_group"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "mc5star.com"] [uri "/forum/admin.php"] [unique_id "XrCmzVBIv2BjsW3hR5FT5QAAAEI"], referer: https://mc5star.com/forum/admin.php?nodes/staff.3/permissions/edit&user_group_id=3

How to disable specific ModSecurity rules in Plesk

Applicable to: Plesk for Linux Question How to disable specific ModSecurity rules in Plesk per domain or server-wide? Answer Note: Not all rules can be disabled due to the MODSEC-274 bug in Mod...

support.plesk.com