Some people who received our big mailing get a forbidden message when they click on a link that goes to an external site. Most people are not getting the error.
Forbidden You don't have permission to access /sites/all/modules/contrib/civicrm/extern/url.php on this server.
I've tested while not logged in to our website. I've tested on various IP addresses. I've tested while logged in as several types of roles with varying permissions. It's clearly a firewall issue, but if I post it somewhere else, I may push back about it being a CiviCRM issue. Why does my server think that this harmless CiviCRM external link tracking process is a SQL injection concern?
CiviCRM 4.7.15 Drupal 7
Apache SSL Error log reports:
[Tue Oct 10 23:45:07.760744 2017] [:error] [pid 27564:tid 140558165042944] [client 107.77.xxx.xxx] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(^[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98;]+|[\\"'`\\xc2\\xb4\\xe2\\x80\\x99\\xe2\\x80\\x98;]+$)" at REQUEST_COOKIES:ajs_user_id. [file "/usr/share/modsecurity-crs/activated_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "64"] [id "981318"] [rev "2"] [msg "SQL Injection Attack: Common Injection Testing Detected"] [data "Matched Data: \\x22 found within REQUEST_COOKIES:ajs_user_id: \\x224622165\\x22"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "8"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"] [hostname "www.fosterclub.com"] [uri "/sites/all/modules/contrib/civicrm/extern/url.php"] [unique_id "Wd1bg857a7YAAGus-PcAAADK"]
I'm stumped because I can't reproduce the error. The error log only shows a few of these but the access log shows several times the link was successfully accessed. Can't find a pattern.
Here is a screenshot that someone sent me.
Edit: the file permissions for /sites/all/modules/contrib/civicrm/extern/url.php:
-rw-rw-r-- 1 drupal-user server-group 1707 Apr 17 04:44 url.php
Link in email:
https://www.example.com/sites/all/modules/contrib/civicrm/extern/url.php?u=123099&qid=4531881
CiviMail translated that link from what we put in, which is the ultimate destination. Should be an auction site.
chmod 775 -R sites/all/modules/contrib/civicrm/extern
and I'm hoping that will solve the problem, but I can't reproduce it in order to test...