Issue Apache Error 403 Make Server Crash (AND BURN!)

[FrankNX01]

Ok I've been using Plesk for more than 5 years now on a older server.

This week I've install a new server from OVH : Intel Xeon E3-1231v3 - 32GB - SoftRaid 4x2To

CentOS 7 Fresh install than a also fresh install of Plesk Obsidian, so far so good...
I've restore all my WP site from the previous server and again no problem,

Than I've try to import a WP from another provider (cPanel PHP 7.2 Linux ?? no idea)
The site was not in https so lots of link are broken but other than that it was running the latest version of WP.

==== NOW MY PROBLEM ====

The theme I'm using try to load some fonts but not in https (ok I get it it's refused by the browser, security policies, the dev grand mother and so on..,)
What I'm no getting is it make the server die and unavailable, everything crash!
1- The site (let's "pretend" it's okay)
2- All other sites on this server (Well this is strange)
3- Plesk (Ok this is getting stupid)
4- SSH not even responding....
The only way out of this is a hard reboot

The logs file stop at :
ModSecurity: Access denied with code 403 (phase 1). Matched phrase "-C" at MATCHED_VAR. [file "/etc/httpd/conf/modsecurity.d/rules/comodo_free/21_PHP_PHPGen.conf"] [line "19"] [id "220030"] [rev "8"] [msg "COMODO WAF: Vulnerability in PHP before 5.3.12 and 5.4.x before 5.4.2 (CVE-2012-1823)||www.websites.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.websites.com"] [uri "/wp-content/themes/sweettooth/assets/css/simple-line-icons/fonts/Simple-Line-Icons.woff"] [unique_id "Xv8x5PB95dGC@oAqSy36@QAAAIY"], referer: https://www.websites.com/wp-content...le-line-icons/simple-line-icons.css?ver=5.4.2 Apache error

I KNOW I can fix the call for that font but that doesn't solve this bug if all I have to do is call a non https file to make the server crash well....

Thanks

 

[Hex]

It seems to me that the Comodo Free ModSecurity rules blocked the font request but it shouldn't crash the server, only the website at most. Or there are unsupported PHP versions that triggered this error with "Comodo" ModSec.

You have three options:

1- Disable the ModSecurity Completely and see if the crash still persists.

* If the crash disappeared, switch to Atomic rules or exclude WordPress from the list of rules set.
*If you want to keep your ModeSecurity settings as is, change Comodo settings by adding the rule ID taken from the log [id "220030"] and add that ID into the deactivated rules box and see if you can switch that noise off:​

​

*If the crash still persists, move to the second option.​

2. Change the PHP version to 7.2 or 7.3 and update your WordPress install.
3. Take a deep breath and open a support ticket.

 

[FrankNX01]

Thanks, I've disabled it in the Firewall section and it now "works" but before that I had to reinstall CentOS from scratch the server was dead I try rebooting it many times and I couldn't login anymore I had a few seconds after reboot but not enough to login and kill the faulty process...

Keep you posted I haven't try to re-enable this rules in the Firewall to see if it still hang...

 

[Hex]

I had a few seconds after reboot

You can use Plesk CLI in these times.

Turn WAF engine completely off:

plesk bin server_pref --update-web-app-firewall -waf-rule-engine off

I haven't try to re-enable this rules

If you do, execute this command to enable ModeSecurity and switch rule set to Atomic Standard:

plesk bin server_pref --update-web-app-firewall -waf-rule-engine on -waf-rule-set tortix

Or you can just turn WAF off for that particular domain only: (replace example.com with your domain)

plesk bin subscription --update-web-app-firewall example.com -waf-rule-engine off

If you want WAF to just check and collect logs only without any action.

plesk bin subscription --update-web-app-firewall example.com -waf-rule-engine detection-only