OWASP ModSecurity Core Rule Set V3.0 notifications

Userr020

• October 08, 2020 04:00

I have lot of same notifications ModSecurity" Tools / 127.0.0.1 - WARNING - 200 920280: Request Missing a Host Header. How fix this? This block ip 127.0.0.1 or what?

• 

  SamA

  • October 08, 2020 09:58

  Hello, You generally do not want to block requests from 127.0.0.1/localhost as this is the server itself processing requests locally. Blocking this IP may cause unexpected behavior with the cPanel & Software installation. In rare instances, it can be a result of a rouge API processing excessive requests but this is rather uncommon. Here is the rule logic for "Request Missing a Host Header" as to why it would be triggered: # -=[ Rule Logic ]=- # These rules will first check to see if a Host header is present. # The second check is to see if a Host header exists but is empty.
  If any of these conditions are met, the ModSecurity rule regarding "Request Missing a Host Header" will be generated. Are you able to provide us with the full output of the ModSecurity entry for that instance (omitting your IP Address and hostname)? Additionally, are you doing anything in particular to cause this entry? If so, are you able to replicate it, and disclose those steps?

  0
• 

  Kent Brockman

  • October 14, 2020 20:49

  Hello guys, this issue is happenning since 2017 and is well known by cPanel. But yet, they didn't manage to fix it: It is not the best workaround, cause the correct method should be that cPanel enabled an owned filter to exclude petitions to whm-server-status and/or when coming from 127.0.0.1. You can grab a custom rule for doing that in this link: Now, to all the cPanel staff, PLEASE bring this to the developer team's attention. THREE YEARS COUNTING and is still pending a fix. On a personal note, disabling rule 920280 is now part of my setup routine when configuring every new cPanel server. Ridiculous, indeed. But it solves the issue. Best regards

  0
• 

  havenswift

  • January 07, 2021 12:15

  The issue we are seeing across a couple of servers is very similar to this - rule 920280 being tripped every 5 minutes or so from 127.0.0.1 but the Request is Get / We therefore modified the previously given custom rule as follows and this works perfectly # Rule to allow requests from 127.0.0.1 with missing mandatory headers. # SecRule REMOTE_ADDR "@ipMatch 127.0.0.1" \ "msg:'Matched 127.0.0.1. Disabling rules 920280 and 920350',\ phase:1,\ id:8888777,\ t:none,\ pass,\ nolog,\ ctl:ruleRemoveById=920280,\ ctl:ruleRemoveById=920350"
  

  0

Please sign in to leave a comment.