I am running the latest version of Modsecurity on Ubuntu 18.04 and I'm having an odd problem that I cannot find through searching.
The problem is that certain visitors to my server are posting the entire contents of web pages to the log. The posts are usually GET and Content Length is often 14818 or longer.
Obviously, this makes the logs MUCh larger, but more importantly, hinders the security by bogging it down while analyzing so much content.
The log is far to large to post here so I've only posted the top header lines. The Content starts in the "--03dd7202-E--" section below and goes on for another 350 lines or so. It's the full content of the index.html file in the root of the domain directory. The connection appears to be of Russian origin so does that mean anything?
I don't see how this is an acceptable behavior? I do not see this content in the apache2 logs, only in the Modsec_audit.log
Hopefully someone has herd of this problem and can suggest a direction to look without the entire log itself. It's over 400 lines long. Too much to post here.
Note: This is not about uploading files of any sort. This is about the fact that I'm getting the content of web pages (on my server) in the modesecurity log.
Thanks
--03dd7202-A--
[03/Mar/2019:18:20:30 --0500] XHnhBvbr4wow5A1f3YZxVmAAAAU 46.118.156.122 34262 192.168.4.12 80
--03dd7202-B--
GET / HTTP/1.1
Referer: https://mamylik.ru/
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; WOW64; SV1; .NET CLR 2.0.50727)
Host: MySampleDomain.com
--03dd7202-F--
HTTP/1.1 200 OK
Set-Cookie: phpbb3_t6uai_u=1; expires=Mon, 02-Mar-2020 23:20:30 GMT; path=/; domain=MySampleDomain.com; secure; HttpOnly
Set-Cookie: phpbb3_t6uai_k=; expires=Mon, 02-Mar-2020 23:20:30 GMT; path=/; domain=MySampleDomain.com; secure; HttpOnly
Set-Cookie: phpbb3_t6uai_sid=b5b4cde34n4520cac0f57bb30657e4b9; expires=Mon, 02-Mar-2020 23:20:30 GMT; path=/; domain=MySampleDomain.com; secure; HttpOnly
Cache-Control: private, no-cache="set-cookie"
Expires: Sun, 03 Mar 2019 23:20:30 GMT
Vary: Accept-Encoding
Content-Length: 14818
Content-Type: text/html; charset=UTF-8
--03dd7202-E--
<!DOCTYPE html>
<html dir="ltr" lang="en-gb">
<head>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>MySampleDomain.com - Index page</title>
<link rel="alternate" type="application/atom+xml" title="Feed - MySampleDomain.com" href="/app.php/feed?sid=b5b4cde34n4520cac0f57bb30657e4b9"> <link rel="alternate" type="application/atom+xml" title="Feed - New Topics" href="/app.php/feed/topics?sid=b5b4cde34n4520cac0f57bb30657e4b9">
<link href="./assets/css/font-awesome.min.css?assets_version=2" rel="stylesheet">
<link href="./styles/elegance_3.2.5/theme/stylesheet.css?assets_version=2" rel="stylesheet">