2

Some people who received our big mailing get a forbidden message when they click on a link that goes to an external site. Most people are not getting the error.

Forbidden You don't have permission to access /sites/all/modules/contrib/civicrm/extern/url.php on this server.

I've tested while not logged in to our website. I've tested on various IP addresses. I've tested while logged in as several types of roles with varying permissions. It's clearly a firewall issue, but if I post it somewhere else, I may push back about it being a CiviCRM issue. Why does my server think that this harmless CiviCRM external link tracking process is a SQL injection concern?

CiviCRM 4.7.15 Drupal 7

Apache SSL Error log reports:

[Tue Oct 10 23:45:07.760744 2017] [:error] [pid 27564:tid 140558165042944] [client 107.77.xxx.xxx] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(^[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98;]+|[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98;]+$)" at REQUEST_COOKIES:ajs_user_id. [file "/usr/share/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "64"] [id "981318"] [rev "2"] [msg "SQL Injection Attack: Common Injection Testing Detected"] [data "Matched Data: \\x22 found within REQUEST_COOKIES:ajs_user_id: \\x224622165\\x22"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "www.fosterclub.com"] [uri "/sites/all/modules/contrib/civicrm/extern/url.php"] [unique_id "Wd1bg857a7YAAGus-PcAAADK"]

I'm stumped because I can't reproduce the error. The error log only shows a few of these but the access log shows several times the link was successfully accessed. Can't find a pattern.

Here is a screenshot that someone sent me. enter image description here

Edit: the file permissions for /sites/all/modules/contrib/civicrm/extern/url.php:

-rw-rw-r-- 1 drupal-user server-group 1707 Apr 17 04:44 url.php

Link in email:

https://www.example.com/sites/all/modules/contrib/civicrm/extern/url.php?u=123099&qid=4531881

CiviMail translated that link from what we put in, which is the ultimate destination. Should be an auction site.

Improve this question
3
  • I chmod 775 -R sites/all/modules/contrib/civicrm/extern and I'm hoping that will solve the problem, but I can't reproduce it in order to test...
    – Christia
    Oct 11, 2017 at 5:31
  • the link you have in the email is an 'absolute' link isn't it?
    – petednz - fuzion ♦
    Oct 11, 2017 at 18:16
  • Updated my question to include the link. I'm not sure what you mean by absolute link.
    – Christia
    Oct 11, 2017 at 19:12

1 Answer 1

Reset to default
2

You're correct, this is not CiviCRM-related.

Your Apache log is showing that mod_security is the culprit here. mod_security is a "web application firewall" - it sits between the user and Drupal/CiviCRM. It's used to block access to the application when it thinks the interaction is malicious.

From the log, I can see that it's blocking part of the cookie associated with ajs_user_id. A quick Google search says that ajs_user_id is probably tied to segment.com's analytics.js. Does that ring a bell?

The answer is to go to your webhost/sysadmin and show them this error; they should be able to change the mod_security logs. If they refuse, I recommend changing webhosts. If that's not an option, disable analytics.js.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.