Hi all, this may be nothing but I wanted to post my experience this morning with our website suddenly refusing PUT requests. This morning I visited the WHM interface and got an upgrade popup saying that new ModSecurity rules would be installed (my memory is not perfect but it definitely informed me of a change), which I accepted.
Our REST API supports the usual GET, POST, PUT, DELETE etc HTTP verbs and this morning our staff found that a PUT request was being rejected. The browser got a 403 Forbidden response. Looking into the logs in /var/log/apache2/error_log I saw things like this:
This was completely new to me and I had to do some emergency googling and digging.
I went to the WHM interface and found ModSecurity Configuration -> Rules Engine which was set to "Process the rules", I changed this to "Process the rules in verbose mode, but do not execute disruptive actions." but this did not resolve the issue.
Since the error_log mentioned tx.allowed_methods, I ran "find /etc -name \*.conf | xargs grep 'tx.allowed_methods'" and found this file:
conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-901-INITIALIZATION.conf
Which contained this:
# Default HTTP policy: allowed_methods (rule 900200)
SecRule &TX:allowed_methods "@eq 0" \
"id:901160,\
phase:1,\
pass,\
nolog,\
ver:'OWASP_CRS/3.3.0',\
setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"
This appears to deny PUT and DELETE (and other) verbs. I edited this file to add "PUT DELETE", restarted the server, and our staff can now operate normally.
The timestamp on that file was 12 November 2020, more than 1 month ago. I don't know cpanel/whm well enough to know how to trace when or how it was installed/updated.
Hopefully this might help others
Please feed back if there's anything about the above that's not correct.
Nick
Our REST API supports the usual GET, POST, PUT, DELETE etc HTTP verbs and this morning our staff found that a PUT request was being rejected. The browser got a 403 Forbidden response. Looking into the logs in /var/log/apache2/error_log I saw things like this:
Code:
[Tue Dec 15 07:47:24.900788 2020] [:error] [pid 23593] [client 1.2.3.4:37090] [client 1.2.3.4] ModSecurity: Warning. Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "43"] [id "911100"] [msg "Method is not allowed by policy"] [data "PUT"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272/220/274"] [tag "PCI/12.1"] [hostname "our.hostname.com"] [uri "/our_rest_api/thing/foo/bar/"] [unique_id "X9hqDLE8XboxX7bDSJdE5wAAAD4"], referer: https://our.hostname.com/path/to/file.phpI went to the WHM interface and found ModSecurity Configuration -> Rules Engine which was set to "Process the rules", I changed this to "Process the rules in verbose mode, but do not execute disruptive actions." but this did not resolve the issue.
Since the error_log mentioned tx.allowed_methods, I ran "find /etc -name \*.conf | xargs grep 'tx.allowed_methods'" and found this file:
conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-901-INITIALIZATION.conf
Which contained this:
# Default HTTP policy: allowed_methods (rule 900200)
SecRule &TX:allowed_methods "@eq 0" \
"id:901160,\
phase:1,\
pass,\
nolog,\
ver:'OWASP_CRS/3.3.0',\
setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"
This appears to deny PUT and DELETE (and other) verbs. I edited this file to add "PUT DELETE", restarted the server, and our staff can now operate normally.
The timestamp on that file was 12 November 2020, more than 1 month ago. I don't know cpanel/whm well enough to know how to trace when or how it was installed/updated.
Hopefully this might help others
Please feed back if there's anything about the above that's not correct.Nick
Last edited:
