ModSecurity on CyberPanel Problem Stripe hooks

Support and Discussion Web Server
1

Hi Guys, My website use to work normally after I followed the instruction to enable and install ModSecurity.
if any of my customers want to pay using stripe after payment when he clicks on return to the merchant they will have ‘‘403 Forbbiden error’’ and their balance will not be updated.
And in the same time, I can’t deactivate the security. How can I fix this problem ??

The URL like this would be blocked by the ModSecurity:

https://example.com/add_funds/stripe3ds/complete?session_id=cs_live_a14EHSM5SIWbb5DhvF&paymentOption=stripe3ds&orderId=ORDS165271

Please help & Thank you

2

See from logs which rule block that and disable it.

2 Likes
3

I have the same problem, how did you solve it? @RO3B ?

4

Can you check that which rule is blocking this request and disable that specific rule.

1 Like
6

Thanks!

Wouldn’t it be possible to disable it by adding a rule?

From what I understand the only way is to identify the package and disable the item completely, right?

I’ve tried and it doesn’t work to add a rule like this for example:
SecRule REQUEST_URI "@contains landingpages" "id:1001,phase:1,t:none,pass, nolog,ctl:ruleRemoveById=943120",

it would not be ideal to disable one of these items as the false positive is only in a URL.

image
image3391×1264 155 KB

thx

7

It only worked when I went to the file and deleted line 79:
usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/rules/REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION.conf

SecRule REQUEST_URI "@contains landingpages" "id:1001,phase:1,t:none,pass, nolog,ctl:ruleRemoveById=943120",

It doesn’t work if you add the rules via cyberpanel

8

When you update cyberpanel your edit will be overwritten. You can go on cyberpanel modsecurity settings and disable rule 943.

9

I did that, it really works, but shouldn’t the rules work?

I would like to disable 943 just for the specific URL, so all my other 20 sites are vulnerable to these attacks because of a single URL.

10

This ticket continues here: