Issue Plesk 18.0.82 breaks Nginx with ModSecurity 3.0/Comodo?

[ChristophRo]

Server operating system version

Debian 12

Plesk version and microupdate number

18.0.82 #1

Just a heads up, the lastest Plesk update seems to break Nginx on at least Debian 12 systems, when ModSecurity 3.0 is running on Nginx with the Comodo ruleset.
After the update, the Nginx will no longer run/start and throws the following error:

nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /etc/nginx/modsecurity.d/rules/comodo_free/30_Apps_OtherApps.conf. Line: 5650. Column: 27. Invalid regular expression: ^[\d-:]+$  in /etc/nginx/conf.d/modsecurity.conf:6
nginx: configuration file /etc/nginx/nginx.conf test failed

We've removed the file /etc/nginx/modsecurity.d/rules/comodo_free/30_Apps_OtherApps.conf on our servers, to get everything running again

 

[Sebahat.hadzhi]

Thank you for the report, @ChristophRo . Is there any chance you can create an archive of /etc/nginx/modsecurity.d/rules/comodo_free/ and attach it to this thread? Thanks in advance.

 

[ChristophRo]

attached this folder
all these files did not change, so it probably has more to do with the ModSecurity 3 update to 3.0.17

 

[tessa67]

Hi @ChristophRo, @Sebahat.hadzhi,

I went through the archive. The failing regex is in rule 240590 (LimeSurvey, CVE-2015-5078) in 30_Apps_OtherApps:

SecRule ARGS_POST:closedate “!@rx ^[\d-:]+$”

PCRE2 rejects a hyphen right after a class escape like \d inside a character class (“invalid range in character class”), while old PCRE1 treated it as a literal. I reproduced this with PCRE2 10.42. It is the only regex in the whole ruleset that fails this check (I tested all single-line @rx patterns). So it looks like the Nginx ModSecurity build now uses PCRE2, but I can’t confirm that from the release notes.

Instead of removing the whole file, you can fix just this rule by moving the hyphen to the end, which matches the same characters:

cp -a /etc/nginx/modsecurity.d/rules/comodo_free/30_Apps_OtherApps.conf /root/30_Apps_OtherApps.conf.orig
sed -i ‘s/!@rx ^[\d-:]+$/!@rx ^[\d:-]+$/’ /etc/nginx/modsecurity.d/rules/comodo_free/30_Apps_OtherApps.conf
nginx -t

Note: the archive only contains 30_Apps_OtherApps.BAK (line 5677 there vs. 5650 in the error), so I couldn’t check the original .conf. A ruleset update will probably overwrite the change until Comodo or Plesk fixes the rule.

Regards
Tessa