Not the first one with ModSecurity: Access denied with code 403 (phase 2).... issues.
But the thing is, I have a server, multiple websites, multiple webmail users and nobody is having any issues. There is this one user that keeps having issues sending email via webmail.
The full error is:
[client 86.xx.xxx.xxx] ModSecurity: Access denied with code 403 (phase 2).
Pattern match "(?i)((?:\\\\bx(?:link:href|html|mlns)|!ENTITY\\\\b.*?
\\\\b(?:SYSTEM|PUBLIC)|\\\\bdata:text\\\\/html))" at ARGS:Parameters.
[file "/etc/apache2/modsecurity.d/rules/comodo_free/07_XSS_XSS.conf"]
[line "173"] [id "213060"] [rev "5"] [msg "COMODO WAF: XSS Filter -
Category 3: Attribute Vector||mail.mywebsite.nl|F|2"] [severity "CRITICAL"]
[tag "CWAF"] [tag "XSS"] [hostname "mail.mywebsite.nl"] [uri "/"] [unique_id "ZJqH1d8z978UF9Ye1LgFlwAAAEw"],
referer: https://mail.mywebsite.nl/
I've whitelisted his (dynamic) IP address(es) multiple times, and then he can send some mail, up until his new dynamic email address is blacklisted once again.
Since it is referring to XSS, (which I hardly have any experience with), could it be that he has a faulty browser plugin for example that my server is blocking? Any thoughts on how to fix this on my side OR to tell him that it might be his fault? Non of the other users (and I really have plenty!) are facing any issues via webmail!
So, I'm not sure if this is a server issue or that this specific user has some issues on his computer...
[edit] ID 213060 gives the following:
SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|ARGS_NAMES|ARGS|XML:/*|!ARGS:/body/|!ARGS:/content/|!ARGS:/description/|!ARGS:Post|!ARGS:desc|!ARGS:html_message|!ARGS:text|!ARGS:/jform\[params\]\[offcanvas_topmod_style\]/|!ARGS:/jform\[params\]\[djmegamenu-module_style\]/|!ARGS:/jform\[params\]\[offcanvas_botmod_style\]/ "@rx (?i)((?:\bx(?:link:href|html|mlns)|!ENTITY\b.*?\b(?:SYSTEM|PUBLIC)|\bdata:text\/html))" \
"id:213060,msg:'COMODO WAF: XSS Filter - Category 3: Attribute Vector||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:removeNulls,t:removeComments,t:compressWhiteSpace,rev:5,severity:2,tag:'CWAF',tag:'XSS'"
[another edit:]
--8f8b2a62-A--
[27/Jun/2023:08:39:04.952346 +0200] ZJqECGcNX@kM-QmM3hU2ywAAABM 86.client ip 40330 85.server ip 7081
--8f8b2a62-B--
POST /?/Api/ HTTP/1.0
Host: mail.mywebsite.nl
X-Real-IP: 86.client ip
Connection: close
Content-Length: 8345
sec-ch-ua: "Not.A/Brand";v="8", "Chromium";v="114", "Microsoft Edge";v="114"
x-deviceid: 04778820-c6fc-41c1-9d22-3e6f995c03bf
sec-ch-ua-mobile: ?0
authorization: Bearer E1z-PplCaKTj68q73HG0bkSPgUCo_2KSStng_bk5JhGuF_IY5ctiCgm6NHBzru9XB7rvVwBDpBRndZp485pIijLk8pAd7ca5EvpGQF0p312jjCfvYcsy7yl3LDmHNWF5hGxK0PuUn5xOj4PRD7x0tnvlcOW-1IKInsitA5l4VCWTN04iFeQLG22gwRplcDfi-Kq33fwGDDP0yp7bYPq3vA0oyQv_9rWDQN3xF0MOasocYqA4VfIOd2wv31rxoTUj71gzuu6OELNfQSfTBbuUsE3K80I
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.58
content-type: application/x-www-form-urlencoded; charset=UTF-8
accept: application/json, text/javascript, */*; q=0.01
x-requested-with: XMLHttpRequest
x-client: WebClient
sec-ch-ua-platform: "Windows"
origin: https://mail.mywebsite.nl
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://mail.mywebsite.nl/
accept-encoding: gzip, deflate, br
accept-language: nl,en;q=0.9,en-GB;q=0.8,en-US;q=0.7
cookie: AuthToken=E1z-PplCaKTj68q73HG0bkSPgUCo_2KSStng_bk5JhGuF_IY5ctiCgm6NHBzru9XB7rvVwBDpBRndZp485pIijLk8pAd7ca5EvpGQF0p312jjCfvYcsy7yl3LDmHNWF5hGxK0PuUn5xOj4PRD7x0tnvlcOW-1IKInsitA5l4VCWTN04iFeQLG22gwRplcDfi-Kq33fwGDDP0yp7bYPq3vA0oyQv_9rWDQN3xF0MOasocYqA4VfIOd2wv31rxoTUj71gzuu6OELNfQSfTBbuUsE3K80I; DeviceId=04778820-c6fc-41c1-9d22-3e6f995c03bf; aft-cache-ctrl=1
--554ba553-C--
Module=Mail&Method=SendMessage&Parameters=%7B%22AccountID%22%3A13%2C%22IdentityID%22%3A164%2C%22AliasID%22%3A%22%22%2C%22FetcherID%22%3A%22%22%2C%22DraftInfo%22%3A%5B%22reply%22%2C%22175%22%2C%22INBOX%22%5D%2C%22DraftUid%22%3A%22%22%2C%22To%22%3A%22user%40personalmail.nl%22%2C%22Cc%22%3A%22%22%2C%22Bcc%22%3A%22%22%2C%22Subject%22%3A%22RE%5B2%5D%3A+trainen%22%2C%22Text%22%3A%22%3Cdiv+data-crea%3D%5C%22font-wrapper%5C%22+style%3D%5C%22font-family%3A+Tahoma%2C+sans-serif%3B+font-size%3A+16px%3B+direction%3A+ltr%5C%22%3E%3Cdiv+style%3D%5C%22font-family%3A+Tahoma%3B+font-size%3A+16px%5C%22%3E%3C%2Fdiv%3Edag+Kees%2C%3Cdiv%3E%3Cbr%3E%3C%2Fdiv%3E%3Cdiv%3EFijn+dat+het+trainen+je+bevalt.%3C%2Fdiv%3E%3Cdiv%3E%3Cbr%3E%3C%2Fdiv%3E%3Cdiv%3EJe+afwezigheid+volgende+week+is+genoteerd.%26nbsp%3B+Bedankt+voor+het+tijdig+doorgeven.%3C%2Fdiv%3E%3Cdiv%3E%3Cbr%3E%3Cbr%3E%3Cdiv%3E%3Cdiv+data-crea%3D%5C%22font-wrapper%5C%22+style%3D%5C%22font-family%3A+Tahoma%2C+sans-serif%3B+font-size%3A+16px%3B+direction%3A+ltr%5C%22%3EMet+vriendelijke+groeten%2C%3Cdiv%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cbr%3E%3C%2Fdiv%3E%3Cdiv%3ECees+van+lastname%3C%2Fdiv%3E%3Cdiv%3ECo%C3%B6rdinator+Sport+Overdag+ttv+MySportclub%3C%2Fdiv%3E%3Cdiv%3Email%3A+faultyaddress%40mywebsite.nl%3C%2Fdiv%3E%3Cdiv%3E06-xxxxxxxx%3C%2Fdiv%3E%3Cdiv%3Epriv%C3%A9+mail%3A+user%40personalmail.nl%3C%2Fdiv%3E%3Cdiv%3E%3Cbr%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cfont+size%3D%5C%222%5C%22%3EAls+je+geen+mail+meer+wil+ontvangen+van+SportOverdag+van+ttv+MySportclub%2C+laat+me+dat+dan+even+weten.%3C%2Ffont%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3Cbr%3E%3Cbr%3E%3Cdiv+data-anchor%3D%5C%22reply-title%5C%22%3EOp+ma.%2C+jun.+26%2C+2023+om+14%3A28%2C+user%40personalmail.nl+schreef%3A%3C%2Fdiv%3E%3Cblockquote%3E%3Cdiv+data-x-div-type%3D%5C%22html%5C%22+xmlns%3Av%3D%5C%22urn%3Aschemas-microsoft-com%3Avml%5C%22+xmlns%3Ao%3D%5C%22urn%3Aschemas-microsoft-com%3Aoffice%3Aoffice%5C%22+xmlns%3Aw%3D%5C%22urn%3Aschemas-microsoft-com%3Aoffice%3Aword%5C%22+xmlns%3Am%3D%5C%22http%3A%2F%2Fschemas.microsoft.com%2Foffice%2F2004%2F12%2Fomml%5C%22+xmlns%3D%5C%22http%3A%2F%2Fwww.w3.org%2FTR%2FREC-html40%5C%22%3E%3Cdiv+data-x-div-type%3D%5C%22body%5C%22+lang%3D%5C%22NL%5C%22+link%3D%5C%22%230563C1%5C%22+vlink%3D%5C%22%23954F72%5C%22+style%3D%5C%22word-wrap%3A+break-word%5C%22%3E%3Cdiv%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3ECees+%2Cdankjewel%2C%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3E%3C%2Fspan%3E%3Cbr+%2F%3E%26nbsp%3B%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3EDonderdag+a.s.+ben+ik+er+wel+en+leuk+om+tegen+Moh+te+oefenen%2C%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3EAfgelopen+donderdag+was+erg+goed+om+tegen+AH-Tong+te+hebben+getraind%E2%80%A6..+%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3E%26nbsp%3B%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3E%3C%2Fspan%3E%3Cbr+%2F%3E%26nbsp%3B%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3EVolgende+week+donderdag+6+juli+ben+ik+verhinderd%3B+dus+dan+niet+inplannen+voor+training+%26nbsp%3B%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3E%3C%2Fspan%3E%3Cbr+%2F%3E%26nbsp%3B%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3EGroet%2C+%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3EKees+%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3E%3C%2Fspan%3E%3Cbr+%2F%3E%26nbsp%3B%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3E%3C%2Fspan%3E%3Cbr+%2F%3E%26nbsp%3B%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cspan+style%3D%5C%22mso-fareast-language%3A+EN-US%5C%22%3E%3C%2Fspan%3E%3Cbr+%2F%3E%26nbsp%3B%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cdiv%3E%3Cdiv+style%3D%5C%22border%3A+none%3Bborder-top%3A+solid+%23E1E1E1+1.0pt%3Bpadding%3A+3.0pt+0cm+0cm+0cm%5C%22%3E%3Cb%3EVan%3A%3C%2Fb%3E+Cees+van+lastname+%26lt%3Bfaultyaddress%40mywebsite.nl%26gt%3B+%3Cbr%3E%3Cb%3EVerzonden%3A%3C%2Fb%3E+maandag+26+juni+2023+13%3A44%3Cbr%3E%3Cb%3EAan%3A%3C%2Fb%3E+Sport+Overdag+%26lt%3Bfaultyaddress%40mywebsite.nl%26gt%3B%3Cbr%3E%3Cb%3EOnderwerp%3A%3C%2Fb%3E+trainen%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3Cbr+%2F%3E%26nbsp%3B%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cdiv%3E%3Cdiv%3E%3Cdiv%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3EZie+bijgevoegd+schema.%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3E%3C%2Fspan%3E%3Cbr+%2F%3E%26nbsp%3B%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3ETot+donderdag.%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cdiv%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3EMet+vriendelijke+groeten%2C%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3E%3C%2Fspan%3E%3Cbr+%2F%3E%26nbsp%3B%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3ECees+van+lastname%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3ECo%C3%B6rdinator+Sport+Overdag+ttv+MySportclub%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3Email%3A+%3Ca+href%3D%5C%22mailto%3Afaultyaddress%40mywebsite.nl%5C%22+target%3D%5C%22_blank%5C%22+tabindex%3D%5C%22-1%5C%22+rel%3D%5C%22external%5C%22+class%3D%5C%22external%5C%22%3Efaultyaddress%40mywebsite.nl%3C%2Fa%3E%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3E06-xxxxxxxx%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3Epriv%C3%A9+mail%3A+%3Ca+href%3D%5C%22mailto%3Auser%40personalmail.nl%5C%22+target%3D%5C%22_blank%5C%22+tabindex%3D%5C%22-1%5C%22+rel%3D%5C%22external%5C%22+class%3D%5C%22external%5C%22%3Euser%40personalmail.nl%3C%2Fa%3E%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3E%3C%2Fspan%3E%3Cbr+%2F%3E%26nbsp%3B%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3Cdiv%3E%3Cspan+style%3D%5C%22font-size%3A+10.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3EAls+je+geen+mail+meer+wil+ontvangen+van+SportOverdag+van+ttv+MySportclub%2C+laat+me+dat+dan+even+weten.%3C%2Fspan%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3E%3C%2Fspan%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3Cspan+style%3D%5C%22font-size%3A+12.0pt%3Bfont-family%3A+%26quot%3BTahoma%26quot%3B%2Csans-serif%5C%22%3E%3C%2Fspan%3E%3Cbr+%2F%3E%26nbsp%3B%3Cbr+%2F%3E%3Cbr+%2F%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%3C%2Fblockquote%3E%3C%2Fdiv%3E%3C%2Fdiv%3E%22%2C%22IsHtml%22%3Atrue%2C%22Importance%22%3A3%2C%22SendReadingConfirmation%22%3Afalse%2C%22Attachments%22%3A%7B%7D%2C%22InReplyTo%22%3A%22%3C000201d9a829%24ad56e960%240804bc20%24%40personalmail.nl%3E%22%2C%22References%22%3A%22%3C4bdda8120d59524b9456c25f482efcce%40mail.mywebsite.nl%3E+%3C000201d9a829%24ad56e960%240804bc20%24%40personalmail.nl%3E%22%2C%22Sensitivity%22%3A0%2C%22Method%22%3A%22SendMessage%22%2C%22ShowReport%22%3Atrue%2C%22SentFolder%22%3A%22INBOX.Sent%22%7D&TenantName=Default
--554ba553-F--
HTTP/1.1 403 Forbidden
Last-Modified: Sun, 12 Mar 2023 15:15:00 GMT
ETag: "31b-5f6b57545f770"
Accept-Ranges: bytes
Content-Length: 795
Cache-Control: s-maxage=10
Connection: close
Content-Type: text/html
--8f8b2a62-H--
Message: Access denied with code 403 (phase 2). Pattern match "(?i)((?:\\bx(?:link:href|html|mlns)|!ENTITY\\b.*?\\b(?:SYSTEM|PUBLIC)|\\bdata:text\\/html))" at ARGS:Parameters. [file "/etc/apache2/modsecurity.d/rules/comodo_free/07_XSS_XSS.conf"] [line "173"] [id "213060"] [rev "5"] [msg "COMODO WAF: XSS Filter - Category 3: Attribute Vector||mail.mywebsite.nl|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"]
Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 86.xx.xxx.xxx] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)((?:\\\\\\\\bx(?:link:href|html|mlns)|!ENTITY\\\\\\\\b.*?\\\\\\\\b(?:SYSTEM|PUBLIC)|\\\\\\\\bdata:text\\\\\\\\/html))" at ARGS:Parameters. [file "/etc/apache2/modsecurity.d/rules/comodo_free/07_XSS_XSS.conf"] [line "173"] [id "213060"] [rev "5"] [msg "COMODO WAF: XSS Filter - Category 3: Attribute Vector||mail.mywebsite.nl|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "mail.mywebsite.nl"] [uri "/"] [unique_id "ZJqECGcNX@kM-QmM3hU2ywAAABM"]
Action: Intercepted (phase 2)
Stopwatch: 1687847944917965 34695 (- - -)
Stopwatch2: 1687847944917965 34695; combined=28524, p1=593, p2=27771, p3=0, p4=0, p5=159, sr=124, sw=1, l=0, gc=0
Producer: ModSecurity for Apache/2.9.6 (http://www.modsecurity.org/); CWAF_Apache.
Server: Apache
Engine-Mode: "ENABLED"
Whitelisting the client(s) is not a good idea (in much cases).
You should make an exclusion, for eg.:
SecRule REQUEST_FILENAME "@strEq /" \
"id:1000,\
phase:1,\
pass,\
t:none,\
nolog,\
ctl:ruleRemoveTargetById=213060;ARGS:Parameters"
Check the uri in this rule (it does not seem in your log), fix it, and put this exclusion rule BEFORE the rule above. You can change the operator (@strEq) too if you think the mentioned one is not good enough.
This will make an exclusion: if the URI matches, then target ARGS:Parameters will be removed in case of rule 213060.