IM360 WAF: Request body parsing error - Blocking IP after uploading Wordpress content

[jbeltran]

after installing IM360 and even I have my IP whitelisted, the system, after uploading images, content or what ever, it blocks my IP for a while. I've followed the documentation for checking that my IP is in the whitelist through command line, and everything seems ok but I keep being blocked everytime with this messages:

Would love some help please.

[KBOURDAKOS]

Greetings jbeltran,

I hope you are doing well. Thank you for letting the forum know about your experience with IM360 product.

Generally, The reported error means that the ModSecurity was installed without its' JSON support.
Proceeding with the installation of it and inserting, afterwards, the corresponding reference to the configuration file would be a good idea.


For Ubuntu systems

We can first confirm the absence of the package by running

apt list --installed|grep yajl​

. If it's not there then you can proceed by executing

apt-get install yajl*​

For RedHat based systems

We can first confirm the absence of the package by running

rpm -qa | grep yajl​

. If it's not there then you can proceed by executing

sudo dnf -y install yajl​

Upon the completion of the installation of the package you have to ensure that the line

SecAuditLogFormat JSON​

is included into the modsecurity configuration file. However, without knowing your stack - I can not be certain where this file is located in your system. Nonetheless, feel free to use

for file in `find /etc -iname "modsec*conf" -type f`;do grep "SecAuditLogFormat" $file;done​

which it takes for granted that the conf file is located under /etc of your system and returns the output of SecAuditLogFormat existence or not.

That been said the procedure of change should look like this,

Edit the file /etc/httpd/conf.d/modsec2.imunify.conf, find the SecAuditLogFormat directive in it and adjust it accordingly:

SecAuditLogFormat JSON​

After the completion of the edit you can ensure the integrity of your new configuration by executing

apachectl -t​

In case of PLESK - In certain cases re-installation

plesk installer --select-release-current --remove-component modsecurity

&

plesk installer --select-release-current --install-component modsecurity

may be a quick fix.

Last but not least. Kindly be advised that in case of using NGINX , according to this , such an option can not be supported unless we are talking about a stand-alone installation.


I hope it helped. Take Care