CiviCRM Mailings external links forbidden

Question

Some people who received our big mailing get a forbidden message when they click on a link that goes to an external site. Most people are not getting the error.

Forbidden You don't have permission to access /sites/all/modules/contrib/civicrm/extern/url.php on this server.

I've tested while not logged in to our website. I've tested on various IP addresses. I've tested while logged in as several types of roles with varying permissions. It's clearly a firewall issue, but if I post it somewhere else, I may push back about it being a CiviCRM issue. Why does my server think that this harmless CiviCRM external link tracking process is a SQL injection concern?

CiviCRM 4.7.15 Drupal 7

Apache SSL Error log reports:

[Tue Oct 10 23:45:07.760744 2017] [:error] [pid 27564:tid 140558165042944] [client 107.77.xxx.xxx] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(^[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98;]+|[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98;]+$)" at REQUEST_COOKIES:ajs_user_id. [file "/usr/share/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "64"] [id "981318"] [rev "2"] [msg "SQL Injection Attack: Common Injection Testing Detected"] [data "Matched Data: \\x22 found within REQUEST_COOKIES:ajs_user_id: \\x224622165\\x22"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "www.fosterclub.com"] [uri "/sites/all/modules/contrib/civicrm/extern/url.php"] [unique_id "Wd1bg857a7YAAGus-PcAAADK"]

I'm stumped because I can't reproduce the error. The error log only shows a few of these but the access log shows several times the link was successfully accessed. Can't find a pattern.

Here is a screenshot that someone sent me.

Edit: the file permissions for /sites/all/modules/contrib/civicrm/extern/url.php:

-rw-rw-r-- 1 drupal-user server-group 1707 Apr 17 04:44 url.php

Link in email:

https://www.example.com/sites/all/modules/contrib/civicrm/extern/url.php?u=123099&qid=4531881

CiviMail translated that link from what we put in, which is the ultimate destination. Should be an auction site.

Answer 1

You're correct, this is not CiviCRM-related.

Your Apache log is showing that mod_security is the culprit here. mod_security is a "web application firewall" - it sits between the user and Drupal/CiviCRM. It's used to block access to the application when it thinks the interaction is malicious.

From the log, I can see that it's blocking part of the cookie associated with ajs_user_id. A quick Google search says that ajs_user_id is probably tied to segment.com's analytics.js. Does that ring a bell?

The answer is to go to your webhost/sysadmin and show them this error; they should be able to change the mod_security logs. If they refuse, I recommend changing webhosts. If that's not an option, disable analytics.js.