Payment gateway blocked by mod_security when trying to request Woocommerce endpoint

Question

my payment gateway is blocked by mod_security when trying to access Woocommerce endpoint.
receiving 403 permission denied when trying to access the "/wc-api/my_gateway_payment_callback" endpoint. im on an Litespeed shared host.

when disabling the mod_security from .htaccess

<IfModule mod_security.c>
  SecFilterEngine Off
  SecFilterScanPOST Off
</IfModule>

it solves the issue but exposes Wordpress admin to attacks, so i want to be more specific. i tried to add a LocationMatch

<LocationMatch "/wc-api/my_gateway_payment_callback">
    <IfModule mod_security.c>
        SecRule REQUEST_URI "@beginsWith /wc-api/my_gateway_payment_callback/" \"phase:2,id:1000,nolog,pass, allow, msg:'Update URI accessed'"  
    </IfModule>
</LocationMatch>

or

<IfModule mod_security.c>
    SecRule REQUEST_URI "@beginsWith /my_gateway_payment_callback" \"phase:2,id:1000,nolog,pass, allow, msg:'Update URI accessed'"  
</IfModule>

but they dont work and im still getting the 403 error.

Barry Pollard · Accepted Answer · 2019-08-11T10:25:12.680

I can spot multiple problems here:

<IfModule mod_security.c>
 SecFilterEngine Off
 SecFilterScanPOST Off
</IfModule>

Are you really using ModSecurity v1? That is VERY old and suggests you are using Apache 1 as ModSecurity v1 is not compatible with ModSecurity v1. If not this should be:

<IfModule mod_security2.c>
 SecRuleEngine Off
</IfModule>

Next you say:

it solves the issue but exposes Wordpress admin to attacks

I don't see how it can solve the issue unless you are on REALLY old software, so suspect this is a red herring.

so i want to be more specific. i tried to add a LocationMatch

Good idea to be more specific. However LocationMatch runs quite late in Apache process - after ModSecurity rules will have run so this will not work. However you don’t really need LocationMatch since your rule already scopes it to that location. So let’s look at the next two pieces:

   SecRule REQUEST_URI "@beginsWith /wc-api/my_gateway_payment_callback/" \"phase:2,id:1000,nolog,pass, allow, msg:'Update URI accessed'"  
   SecRuleRemoveById 3000

You shouldn't need to remove the rule if you allow it on the previous lines. Typically you would only do one or the other.

or

<IfModule mod_security.c>
    SecRule REQUEST_URI "@beginsWith /my_gateway_payment_callback" > \
      "phase:2,id:1000,nolog,pass, allow, msg:'Update URI accessed'"  
</IfModule>

but they dont work and im still getting the 403 error.

You have pass (which means continue on to the next rule) and allow (which means skip all future rules). It seems to me you only want the latter and not the former. As these are conflicting, I suspect ModSecurity will action the former first hence why it is not working.

However the better way is to look at the Apache error logs to see what rule it's failing on (is it rule 3000 as per your other LocationMatch workaround?) and just disable that one rule rather than disable all rules for that route.

So all in all I'm pretty confused with your question as seems to be a lot of inconsistencies and things that are just wrong in there...

Thanks @Barry Pollard, i edited the rules to make them more clear. tried this code as you suggested, still 403 forbidden: SecRule REQUEST_URI "@beginsWith /wc-api/my_gateway_payment_callback/" \"phase:2,id:1000, allow, msg:'Update URI accessed'" — buzibuzi, Aug 09 '19 at 06:33
You need to look at the logs to see what rule is firing. It could be a phase 1 rule blocking (which runs before phase 2 rules). On a similar note the ordering counts as if another phase 2 rule is above that one in the config, then it will run first. — Barry Pollard, Aug 09 '19 at 11:41
since this is a shared host, i asked them to check the logs. apparently the mod_security rule id "212770" blocked the call to the end point becuase of the length of the parameters sent by the gateway. the rule was disabled and this fixed the issue. — buzibuzi, Aug 11 '19 at 09:55

Payment gateway blocked by mod_security when trying to request Woocommerce endpoint

1 Answers1