Issue ModSecurity lately feels offended by Wordpress in several customer installations, is triggered by rule 222212

[Bitpalast]

Since yesterday we are seeing several support cases were customers are locked out of their websites by fail2ban as it reacts to a ModSecurity 403 error. That is caused by rule 222212 in Wordpress installations, for example as follows:

[client 77.123.123.12] ModSecurity: Warning. String match "get" at REQUEST_METHOD. [file "/etc/httpd/conf/modsecurity.d/rules/comodo_free/27_Apps_WPPlugin.conf"] [line "3792"] [id "222212"] [rev "2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "<domainname>"] [uri "/wp-admin/edit-comments.php"] [unique_id "Xn5TaY9yZoW9kX79a6a2gAAABBE"], referer: https://<domainname>/wp-admin/edit.php?ids=1

This seems to be occuring in several customer installations. It is always the 27_Apps_WPPlugin.conf that is complaining and always the 222212 rule. Customers are reporting that they were editing their websites while suddenly they are locked out. So actually, they are not doing anything harmful.

The solution of course is to exclude rule 222212 from Web Application Firewall (ModSecurity), but the question is: Why is this suddenly happening and who needs to do something about it? It cannot stay this way, because it means that likely a major part of Wordpress users will be affected and sooner or later lock themselves out by simply working on their websites.

 

[IgorG]

Peter,
We have already KB article about this 'false positive' ModSecure issue Website is not available with enabled ModSecurity: 403 Forbidden
Looks like it is related to default free Comodo ruleset in your case.

 

[Bitpalast]

Yes, I have seen that article before. However, in this case it seems that the one specific rule 222212 is suddenly triggered in many different customers' Wordpress installations where this previously was not triggered. So probably it's an issue with ModSecurity (the ruleset respectively). Maybe I'll need to find a way to let them know.

 

[linuxman1]

Hi Better,
yes please it blocked me many time, I am trying to find a solution!

 

[linuxman1]

I had to bypass this rule ID at mod_security to fix my issue.

 

[Bitpalast]

Is this the fix?
" If the free Comodo rule set is selected and WordPress is installed on a website, Fail2Ban can no longer block the Plesk server’s IP address after customers spend some time working in WordPress. (PPPM-11961) "

 

[bachit]

me too , i can not fix it