A problem with modsecurity and mediawiki, please help!

ServerNoob · 04-01-2011, 08:11 PM

I'm running Apache2 on a Linux server with the latest modsecurity and crs. Modsecurity spits out three XSS errors in the apache2 error.log every time I visit my mediawiki site Main Page. It complains about anomaly score of 5 exceeded and has denied access. Though the mediawiki still works fine and loads as it should. The error doesn't have a rule-id, so I don't know how to fix this so it ignores those three problems in the mediawiki's index.php. Help appreciated thanks!

stickman · 04-01-2011, 10:17 PM

What is the exact error message that is show up in the error log? The log entry usually has a few key words that you can use to find the rule in the modsecurity config file.

ServerNoob · 04-05-2011, 05:21 PM

Thanks stickman for helping me out here.

The error shows the rule, and the access log shows the affected url, so I know all that. I just don't know how to create a whitelist or exception without a rule id number that everyone seems to use. I'm using anomaly scoring mode.

BTW it's hard to copy and paste from the server because the server is a command line linux box.

Thanks again!

stickman · 04-11-2011, 10:31 PM

What is the rule that is blocking the request? Depending on the rule, you might be able to comment it out in the conf, but that would depend on what the scope of the rule is.

BTW, you can still copy-n-paste session, but the method depends on the client. I usually highlight and use shift-del to cut.