Mod_security isnt working : Joomla sites are getting hacked ?

V

vivek

Well-Known Member
#1
#1
Hello

I have a good set of Mod_security 1.9 rules. But when I swap the webserver, ie, when I run Apache , I will get lot of IP block mails from the firewall. From that, I can see the IP address as well as the domain name. But when I switch to litespeed, it is not working with mod security rules. and not reporting the errors in error_log file such that the CSF can read it.

Recently one of my client's site which was a Joomla site, got hacked. I checked the account and found 10 copies of c99.php files as well as a file called sniper.php files. ClamAV antivirus found this as trojans.

Why c99 and snipper codes worked with litespeed+modsec ? I am sure it will not work in the case of apache+modsec

My question is , Why litespeed isnt processing modsec.conf ?
I know the the old version of lsws worked with modsec, but why the new version isnt working with it?

I am using enterprise version since 3+ months now.

My server is handling around 300 http connections ( 500+ on peak time )
I am sure litespeed isnt working with modesec+CSF because when I change to apache, I can see it apache is working fine with those set of rules.

Vivek
 
M

mistwang

LiteSpeed Staff
#2
#2
We need more specific information to investigate this.
The Request URL and security rule that should work but not.
We can try it on your server with mod_security log enabled.
 
M

mistwang

LiteSpeed Staff
#4
#4
Please send me an example URL along with the mod_security rule that should block it. However, it has not been blocked in your server environment, and we can reliably reproduce it on your server, then I will start investigate.

Without those information, I don't know where to start.
 
V

vivek

Well-Known Member
#5
#5
mistwang said:
Please send me an example URL along with the mod_security rule that should block it. However, it has not been blocked in your server environment, and we can reliably reproduce it on your server, then I will start investigate.

Without those information, I don't know where to start.
Click to expand...
Hello

I just uploaded a c99 script to my account. I can see litespeed is not working with modsec in this case.

I changed to apache and it blocked the script.

PMing you the details.

Vivek
 
M

mistwang

LiteSpeed Staff
#7
#7
OK, find a problem with handling "SecFilter" directive, the request URI has not been checked. Uploaded 3.3.11 release package, and it works properly now.

If you find any other issue mod_security rules, please let us know.
 
V

vivek

Well-Known Member
#8
#8
mistwang said:
OK, find a problem with handling "SecFilter" directive, the request URI has not been checked. Uploaded 3.3.11 release package, and it works properly now.

If you find any other issue mod_security rules, please let us know.
Click to expand...
Thank you
I think there are also some other rules other than secFilter, which arent working. I will let you know when I get more info.

Vivek
 
A

anewday

Well-Known Member
#10
#10
Hope George didn't forget to apply all bugfixes (from 3.3 versions) to the beta, I'm waiting for beta2 to test it.
 
Last edited:
You must log in or register to reply here.
Top