Web proof is failing when server has ModSecurity with OWASP Core Rule Set

[tzatko]

Keybase is unable to get keybase.txt when server uses ModSecurity with Core Rule Set. Reason is that keybase is using GET withouth Accept header.

Related log entry: [Thu Aug 14 08:59:12 2014] [error] [client 91.210.183.86] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/httpd/modsecurity.d/activated_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "47"] [id "960015"] [rev "1"] [msg "Request Missing an Accept Header"] [severity "NOTICE"] [ver "OWASP_CRS/2.2.6"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_ACCEPT"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "zatko.sk"] [uri "/keybase.txt"] [unique_id "U@xeQFvStUQAAELiCLoAAAA4"]

[frenck]

Wauw!

This is a very old issue!

Still there... Easy fixable I guess...

Message: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/usr/share/modsecurity-crs/activated_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "47"] [id "960015"] [rev "1"] [msg "Request Missing an Accept Header"] [severity "NOTICE"] [ver "OWASP_CRS/2.2.9"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/MISSING_HEADER_ACCEPT"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] Action: Intercepted (phase 2)

[tzatko]

Yeah. The issue is still there.

[hillaryinnocent]

and what is the fix to this?

[hillaryinnocent]

@frenck do you have a solution to this issue? please share

[frenck]

Sorry, I'm not using Keybase actively anymore.

../Frenck