[RESOLVED] 403 Forbidden error

**Ken B** · Apr 10th, 2008, 11:27 AM

I'm getting the following error

Forbidden

You don't have permission to access /archive/code/get.php on this server.

Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

I have two small php files

send.php

Code:

<?php ?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
  <title>Comment</title>
  <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
</head>

<form action="get.php" method="post">
	<p><textarea name="comments" rows="20" cols="100"></textarea></p>
	<p><input type="submit" value="Send"></input></p>
</form>

</body></html>

get.php

Code:

<?php
	echo $_REQUEST['comments'];
 ?>

If I enter the following text in the textarea, I get the error:

Code:

Bardwell's Ferry, Massachusetts
Train Wreck
April 7, 1886
FEARFUL RAILROAD ACCIDENT

An Express Train Plunges Down an Almost Perpendicular Precipice.

Only Three Persons on Board Known to Have Escaped Injury.

The Coaches Take Fire and the Wounded Passengers are Burned to Death - The Disaster Caused by the Sinking of the Track - A Partial List of the Injured.

GREENFIELD, Mass., April 7. -- A terrible disaster occurred on the Fitchburg railroad to-night, midway between Bardwell's ferry and West Deerfield station, the east bound passenger train, due at Greenfield at 6:05 P. M., going over an embankment 200 feet high. Six bodies have already been taken out of the ruins and it is not known how many others were killed. The train was the eastern express, and consisted of a baggage car, smoker, sleeping car, mail car and two ordinary passenger cars. The train was in charge of Conductor FORSTER, with HERBET LITTLEJOHN as engineer. The point where the accident occurred is the most dangerous on the road. Trains run on the edge of an embankment 200 feet above the Deerfield river. The bank is steep and covered with huge bouilders [sic] and masses of rock. When the train arrived at this point the track commenced to settle under it for a distance covering its entire length. The coaches broke from their trucks and went rolling over and over down the precipice. The engine broke from the tender, tearing up the track for twenty feet. Below rolled the Deerfield river, on the very edge of which the cars were thrown. As soon as they struck they caught fire from the stoves. The sleeping car was an entire wreck. It was occupied by seven passengers, not one of whom at this hour is known to have escaped injury. One man whose name is unknown is imprisoned in the wreck of the sleeper, where he is being buried alive. One little girl was picked up dead.

As soon as the news reached Deerfield a special train was made up and sent to the scene of the disaster, having on board several physicians, section men and a few citizens. On arriving at the scene of the wreck a horrible sight was witnessed. Darkness had settled over the spot. Far down on the river bank could be seen the smouldering embers of the holocaust. It was impossible to tell who was hurt and who was killed. Stout-hearted trackmen were lowered cautiously down the treacherous height and the rescue began.

MERRITT SEELY, superintendent of the National express, of Boston was found in the wreck and taken into the relief car. He had a wound four inches long and half an inch wide over the left temple. His left thigh was broken and also his left leg at the knee. Besides which he sustained internal injuries from which he will die.

D. CRANDALL, postal clerk, was plunged into the river and get ashore with difficulty. He was wounded about the head and his arm was fractured.

The Fitchburg coach was the only one that escaped conflagration. Deputy Sheriff BRYANT, of Greenfield, who was in this car, rescued two children from the flames but one was dead and the other dying. Their parents were on board, but cannot be found. Some of the injured and dead were taken to Shellburne Falls and some of the wounded to Greenfield.

C. P. BELL, of Nashua, N. H., was cut slightly on the head and leg, but was not seriously hurt. He was thrown head foremost into the river and went to the bottom barely escaping drownding [sic].

Conductor FOSTER is reported safe and but slightly injured.

D. C. WELLS of Andover had his shoulder hurt and his head cut. The car in which he was riding was broken in two and stood on end within a few feet of the river bank.
NICHOLAS DORGAN, of Greenfield, had his left arm and ankle broken and was seriously injured internally. A little girl who was a passenger on the train died in his arms from injuries received.

J. E. PRIEST, of Littleton, N. H., had his face and head cut.

Engineer LITTLEJOHN, of North Adams, was badly scalded, it is believed fatally.
A. K. WARNER, chairman of the Greenfield board of selectmen, was badly hurt, but his injuries are not fatal.

Great excitement prevails all along the road between here and North Adams.
Being interviewed by wire to-night at Shellburne Falls, Conductor FOSTER, said: I am unable to state how many were on the train. Only three men have thus far been found who escaped injury, and they place the number of passengers all the way from

If I remove the last letter "m" it works.

If I change the last word "from" to "some new words" it also works.

I'm lost.

**visualAd** · Apr 10th, 2008, 01:44 PM

Your request URI is too long. When you post a form using the GET method the data is appended to the query string; if this string is too long or contains characters that could indicate some kind of attack, the request might fail.

I suggest you use the POST method and access the comments variable using the $_POST variable. When you use the post method the data is sent in the request body whcih can be of an arbitrary length.

**Ken B** · Apr 10th, 2008, 02:21 PM

I changed get.php to

Code:

<?php
  echo  $_SERVER['REQUEST_METHOD'] . "<br/>";
  echo $_POST['comments'];
 ?>

I get the same error. If I change the last character in the string to something other than "m" to "h", it works and displays

Code:

POST
Bardwell\'s Ferry, Massachusetts Train Wreck April 7, 1886 FEARFUL RAILROAD ACCIDENT An Express Train Plunges Down an Almost Perpendicular Precipice. Only Three Persons on Board Known to Have Escaped Injury. The Coaches Take Fire and the Wounded Passengers are Burned to Death - The Disaster Caused by the Sinking of the Track - A Partial List of the Injured. GREENFIELD, Mass., April 7. -- A terrible disaster occurred on the Fitchburg railroad to-night, midway between Bardwell\'s ferry and West Deerfield station, the east bound passenger train, due at Greenfield at 6:05 P. M., going over an embankment 200 feet high. Six bodies have already been taken out of the ruins and it is not known how many others were killed. The train was the eastern express, and consisted of a baggage car, smoker, sleeping car, mail car and two ordinary passenger cars. The train was in charge of Conductor FORSTER, with HERBET LITTLEJOHN as engineer. The point where the accident occurred is the most dangerous on the road. Trains run on the edge of an embankment 200 feet above the Deerfield river. The bank is steep and covered with huge bouilders [sic] and masses of rock. When the train arrived at this point the track commenced to settle under it for a distance covering its entire length. The coaches broke from their trucks and went rolling over and over down the precipice. The engine broke from the tender, tearing up the track for twenty feet. Below rolled the Deerfield river, on the very edge of which the cars were thrown. As soon as they struck they caught fire from the stoves. The sleeping car was an entire wreck. It was occupied by seven passengers, not one of whom at this hour is known to have escaped injury. One man whose name is unknown is imprisoned in the wreck of the sleeper, where he is being buried alive. One little girl was picked up dead. As soon as the news reached Deerfield a special train was made up and sent to the scene of the disaster, having on board several physicians, section men and a few citizens. On arriving at the scene of the wreck a horrible sight was witnessed. Darkness had settled over the spot. Far down on the river bank could be seen the smouldering embers of the holocaust. It was impossible to tell who was hurt and who was killed. Stout-hearted trackmen were lowered cautiously down the treacherous height and the rescue began. MERRITT SEELY, superintendent of the National express, of Boston was found in the wreck and taken into the relief car. He had a wound four inches long and half an inch wide over the left temple. His left thigh was broken and also his left leg at the knee. Besides which he sustained internal injuries from which he will die. D. CRANDALL, postal clerk, was plunged into the river and get ashore with difficulty. He was wounded about the head and his arm was fractured. The Fitchburg coach was the only one that escaped conflagration. Deputy Sheriff BRYANT, of Greenfield, who was in this car, rescued two children from the flames but one was dead and the other dying. Their parents were on board, but cannot be found. Some of the injured and dead were taken to Shellburne Falls and some of the wounded to Greenfield. C. P. BELL, of Nashua, N. H., was cut slightly on the head and leg, but was not seriously hurt. He was thrown head foremost into the river and went to the bottom barely escaping drownding [sic]. Conductor FOSTER is reported safe and but slightly injured. D. C. WELLS of Andover had his shoulder hurt and his head cut. The car in which he was riding was broken in two and stood on end within a few feet of the river bank. NICHOLAS DORGAN, of Greenfield, had his left arm and ankle broken and was seriously injured internally. A little girl who was a passenger on the train died in his arms from injuries received. J. E. PRIEST, of Littleton, N. H., had his face and head cut. Engineer LITTLEJOHN, of North Adams, was badly scalded, it is believed fatally. A. K. WARNER, chairman of the Greenfield board of selectmen, was badly hurt, but his injuries are not fatal. Great excitement prevails all along the road between here and North Adams. Being interviewed by wire to-night at Shellburne Falls, Conductor FOSTER, said: I am unable to state how many were on the train. Only three men have thus far been found who escaped injury, and they place the number of passengers all the way froh

For some reason that "m" is not liked by the server.

**visualAd** · Apr 10th, 2008, 02:55 PM

Can you access the Apache error log? If so will you be able to post the error message associated with that request?

**Ken B** · Apr 11th, 2008, 06:35 AM

I don't have access to the error log.

**Ken B** · Apr 11th, 2008, 08:23 AM

I do have access to the log. You were right, the server thinks its a SQL injection.

Here's the error:

[Fri Apr 11 08:07:06 2008] [error] [client 68.172.117.26] ModSecurity: [file "/etc/httpd/modsecurity.d/10_asl_rules.conf"] [line "133"] [id "340017"] [rev "6"] [msg "Generic SQL injection protection"] [severity "CRITICAL"] Access denied with code 403 (phase 2). Pattern match "(insert[[:space:]]+into.+values|select\\\\s+from.+[a-z|A-Z|0-9]|select.+from|bulk[[:space:]]+insert|union.+select|convert.+\\\\(.*from)" at ARGS:comments. [hostname "www.nyysa.com"] [uri "/archive/code/get.php"] [unique_id "nGQdU38AAAEAAGQtS98AAAEa"]

**visualAd** · Apr 11th, 2008, 10:36 AM

mod_security is intercepting the request. Obviously this is a false positive and upon quick examination of the regular expression it looks as if an overzealous match has caught you out here. Find the expression in your httpd.conf and try removing the bolded part of the expression below:

Code:

(insert[[:space:]]+into.+values|select\\\\s+from.+[a-z|A-Z|0-9]|select.+from|bulk[[:space:]]+insert|union.+select|convert.+\\\\(.*from)

Mod security is an intrusion detection / prevention module for Apache and provides protection against SQL / shell and Javascript injection however, it needs to be fine tuned for individual applications as it can throw false positives as in your case.

**Ken B** · Apr 11th, 2008, 12:06 PM

Make sense. If I just pass "selectmen from" I get the same forbidden error.

Thanks.

**visualAd** · Apr 11th, 2008, 12:38 PM

If you remove that bit then you shouldn't get that anymore.

**Ken B** · Apr 14th, 2008, 07:19 AM

Instead of modifying the security file, I added a .htaccess file that redirect the error to a page that explains the problem. What I would like to do is display the original string that trigger the error and highlite the words that caused the problem. Is there a way to capture the string?

**penagate** · Apr 14th, 2008, 07:55 AM

I don't actually know, but I hypothesise that the answer is no, since that would defeat the purpose of intercepting it.

If you have the access to, mod_security can be safely disabled if you employ best practice programming techniques such as parameterised queries and encoding HTML output using htmlentities() or such.

Thread: [RESOLVED] 403 Forbidden error

Thread Tools

Display

[RESOLVED] 403 Forbidden error

Re: 403 Forbidden error

Re: 403 Forbidden error

Re: 403 Forbidden error

Re: 403 Forbidden error

Re: 403 Forbidden error

Re: 403 Forbidden error

Re: 403 Forbidden error

Re: [RESOLVED] 403 Forbidden error

Re: [RESOLVED] 403 Forbidden error

Re: [RESOLVED] 403 Forbidden error

Posting Permissions