I'm using mod_security on various websites, some WordPress and some not.
I notice that on a non WordPress website the following:
https://test-site.com/?exec=/bin/bash
returns a 403 forbidden error code, along with the Apache "forbidden" error page. The mod_security error is written to the log.
However, on a WordPress install, bizzarely, the following:
https://wordpress-test-site.com/?exec=/bin/bash
returns a 403 forbidden error code and writes the error to the log, however it dispays the contents of the homepage, rather than the Apache "forbidden" error page.
I note that it behaves correctly on any other page, other than the homepage:
https://wordpress-test-site.com/some-page/?exec=/bin/bash
The above works as expected, and returns the Apache error page.
I can only assume this is some conflict with WordPress's mod_rewrite rule which is as follows:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
Is there something I'm missing here? I don't want to display the homepage content when a mod_security rule is matched via the homepage.