Question modsecurity

[Knutsford]

--0c650000-F--
HTTP/1.1 500 Internal Server Error

--0c650000-H--
Message: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/modsecurity_crs-plesk/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1367"] [id "920320"] [msg "Missing User Agent Header"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"]
Apache-Handler: IIS
Stopwatch: 1724281202854194 532436 (- - -)
Stopwatch2: 1724281202854194 532436; combined=0, p1=0, p2=0, p3=0, p4=0, p5=0, sr=0, sw=0, l=0, gc=0
Producer: ModSecurity for IIS (STABLE)/2.9.7 (GitHub - owasp-modsecurity/ModSecurity: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. OWASP_CRS/3.3.5.
Server: ModSecurity Standalone
Engine-Mode: "DETECTION_ONLY"


The designer I work with has got a new server and upgraded the PHP and it seems to be causing problems. Does anyone know what this means please? He has put the PHP back to the old version and it doesn't appear and our PayPal tests worked every time when we did. It seemed to be causing problems with returns from PayPal.

 

[Sebahat.hadzhi]

That indicates that the requests are flagged by the ModSecurity system as suspicious. The rule you are triggering is indemnified with the ID in the error [id "920320"]. You can exclude the rule from the Firewall by following the instructions in this guide.

 

[Knutsford]

--0c650000-F--
HTTP/1.1 500 Internal Server Error

--0c650000-H--
Message: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/modsecurity_crs-plesk/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1367"] [id "920320"] [msg "Missing User Agent Header"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"]
Apache-Handler: IIS
Stopwatch: 1724281202854194 532436 (- - -)
Stopwatch2: 1724281202854194 532436; combined=0, p1=0, p2=0, p3=0, p4=0, p5=0, sr=0, sw=0, l=0, gc=0
Producer: ModSecurity for IIS (STABLE)/2.9.7 (GitHub - owasp-modsecurity/ModSecurity: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. OWASP_CRS/3.3.5.
Server: ModSecurity Standalone
Engine-Mode: "DETECTION_ONLY"


The designer I work with has got a new server and upgraded the PHP and it seems to be causing problems. Does anyone know what this means please? He has put the PHP back to the old version and it doesn't appear and our PayPal tests worked every time when we did. It seemed to be causing problems with returns from PayPal.

Thanks I will pass it on