Cannot disable ModSecurity rules via Switch off security rules in Plesk

Symptoms

• Cannot disable ModSecurity rules: Tools & Settings > Web Application Firewall > General > Switch off security rules list settings are ignored, however, the rule IDs are written to /etc/httpd/conf/plesk.conf.d/server.conf :

  CONFIG_TEXT: SecRuleEngine On
  SecRuleRemoveById 340159 340162 340523

• Access to a website page keeps being blocked with the following error:

  HTTP 403 Forbidden

• The following entry appears in Subscriptions > example.com > Websites & Settings > example.com > Web Application Firewall > Logs:

  ModSecurity: [file "/etc/httpd/conf/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf"] [line "731"] [id "340523"] [rev "5"] [msg "Protected by Atomicorp.com Basic Non-Realtime WAF Rules: Remote File Injection attempt in ARGS (/manager/index.php)"] [severity "CRITICAL"] Access denied with code 403 (phase 2). Match of "beginsWith http://%{SERVER_NAME}/" against "MATCHED_VAR" required. [hostname "www.example.com"] [uri "/manager/index.php"] [unique_id "WShWeH8AAAEAAGUIpxEAAADA"]

Cause

Modsecurity issue MODSEC-274 : rules defined whithin LocationMatch of cannot be excluded by SecRuleRemoveById .

Resolution

1. Go to Subscriptions > example.com > Websites & Settings > example.com > Web Application Firewall > Logs and retrieve the location and the rule ID matched. For example:

ModSecurity: [file "/etc/httpd/conf/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf"] [line "731"] [id "340523"] [rev "5"] [msg "Protected by Atomicorp.com Basic Non-Realtime WAF Rules: Remote File Injection attempt in ARGS (/manager/index.php)"] [severity "CRITICAL"] Access denied with code 403 (phase 2). Match of "beginsWith http://%{SERVER_NAME}/" against "MATCHED_VAR" required. [hostname "www.example.com"] [uri "/manager/index.php"] [unique_id "WShWeH8AAAEAAGUIpxEAAADA"]

2. Go to Subscriptions > example.com > Websites & Domains Apache and nginx Settings > Additional Apache directives and add the following (replacing 1000001 with some unique ID):

<IfModule mod_security2.c>
    SecRule REQUEST_FILENAME "@rx ^/manager/index.php$" "phase:1,id:'1000001',t:none,pass,ctl:ruleRemoveById=340523,ctl:ruleRemoveById=340524"
</IfModule>

3. Press OK to apply the changes.

Note: this issue affects only the rules defined using LocationMatch directive. For the other rules, removing via Tools & Settings > Web Application Firewall > General > Switch off security rules should work.