I know this is not specifically a phplist issue, but the block of my own ip address against itself is the result of phplist running.
Strange - mod_security is issuing a block of my phplist server’s IP against itself because of a mod_security rule called: /OWASP3/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf.
Deep inside the cited mod_security rules/responses is the name of one of phplist’s developers (removed in the below code for privacy) and I’m pretty sure this is not a feature.
Don’t know if this is a configuration issue, or security issue. I doubt it’s a hack but why would mod_security flag this? Below is the mod_security log file with the developer’s name replaced with a long series of zeros 000000000:
[Mon Nov 30 10:26:01.906939 2020] [:error] [pid 3879:tid 47801705469696] [client xx.xx.xx.xx:47782] [client xx.xx.xx.xx] ModSecurity: Access denied with code 403 (phase 4). Matched phrase “Warning:” at RESPONSE_BODY. [file “/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf”] [line “25”] [id “953100”] [rev “3”] [msg “PHP Information Leakage”] [data “Matched Data: Warning: found within RESPONSE_BODY: \x0a<html lang=\x22en\x22 dir=\x22ltr\x22 prefix=\x22og: http://ogp.me/ns#\x22>\x0a\x0a\x0a<meta name=\x22viewport\x22 content=\x22width=device-width, initial-scale=1\x22 />\x0a<meta name=\x22License\x22 content=\x22GNU Affero General Public License, http://www.gnu.org/licenses/agpl.html\x22 />\x0a<meta name=\x22Author\x22 content=\x220000000000000 - http://www.phplist.com\x22 />\x0a<meta name=…”] [severity “ERROR”] [ver “OWASP_CRS/3.0.0”] [maturity “9”] [accuracy “9”] [tag “application-multi”] [tag “language-php”] [tag “platform-multi”] [tag “attack-disclosure”] [tag “OWASP_CRS/LEAKAGE/ERRORS_PHP”] [tag “WASCTC/WASC-13”] [tag "OWASP_TO [hostname “www.xx.xx.xx.xx.com”] [uri “/lists/admin/index.php”] [unique_id “X8UPCeWMuVOodPcTNVMQ3gAAAJA”], referer: https://www.xx.xx.xx.xx.com/lists/admin/?page=import&tk=9be9915e8f550da392f8b9d
[Mon Nov 30 10:26:10.415117 2020] [:error] [pid 3850:tid 47801694963456] [client xx.xx.xx.xx:47784] [client xx.xx.xx.xx] ModSecurity: Access denied with code 403 (phase 4). Matched phrase “Warning:” at RESPONSE_BODY. [file “/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf”] [line “25”] [id “953100”] [rev “3”] [msg “PHP Information Leakage”] [data “Matched Data: Warning: found within RESPONSE_BODY: \x0a<html lang=\x22en\x22 dir=\x22ltr\x22 prefix=\x22og: http://ogp.me/ns#\x22>\x0a\x0a\x0a<meta name=\x22viewport\x22 content=\x22width=device-width, initial-scale=1\x22 />\x0a<meta name=\x22License\x22 content=\x22GNU Affero General Public License, http://www.gnu.org/licenses/agpl.html\x22 />\x0a<meta name=\x22Author\x22 content=\x220000000000000 - http://www.phplist.com\x22 />\x0a<meta name=…”] [severity “ERROR”] [ver “OWASP_CRS/3.0.0”] [maturity “9”] [accuracy “9”] [tag “application-multi”] [tag “language-php”] [tag “platform-multi”] [tag “attack-disclosure”] [tag “OWASP_CRS/LEAKAGE/ERRORS_PHP”] [tag “WASCTC/WASC-13”] [tag "OWASP_TO [hostname “www.xx.xx.xx.xx.com”] [uri “/lists/admin/index.php”] [unique_id “X8UPEuH-zS7IDgq1tNB1ZAAAAAs”], referer: https://www.xx.xx.xx.xx.com/lists/admin/?page=import&tk=9be9915e8fe8f4df29f550da392f8b9d
[Mon Nov 30 10:26:39.309648 2020] [:error] [pid 3881:tid 47801697064704] [client xx.xx.xx.xx:47788] [client xx.xx.xx.xx] ModSecurity: Access denied with code 403 (phase 4). Matched phrase “Warning:” at RESPONSE_BODY. [file “/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-953-DATA-LEAKAGES-PHP.conf”] [line “25”] [id “953100”] [rev “3”] [msg “PHP Information Leakage”] [data “Matched Data: Warning: found within RESPONSE_BODY: \x0a<html lang=\x22en\x22 dir=\x22ltr\x22 prefix=\x22og: http://ogp.me/ns#\x22>\x0a\x0a\x0a<meta name=\x22viewport\x22 content=\x22width=device-width, initial-scale=1\x22 />\x0a<meta name=\x22License\x22 content=\x22GNU Affero General Public License, http://www.gnu.org/licenses/agpl.html\x22 />\x0a<meta name=\x22Author\x22 content=\x220000000000000 - http://www.phplist.com\x22 />\x0a<meta name=…”] [severity “ERROR”] [ver “OWASP_CRS/3.0.0”] [maturity “9”] [accuracy “9”] [tag “application-multi”] [tag “language-php”] [tag “platform-multi”] [tag “attack-disclosure”] [tag “OWASP_CRS/LEAKAGE/ERRORS_PHP”] [tag “WASCTC/WASC-13”] [tag "OWASP_TO [hostname “www.xx.xx.xx.xx.com”] [uri “/lists/admin/index.php”] [unique_id “X8UPL-gJkd8N2 YgAAAQw”], referer: https://www.xx.xx.xx.xx.com/lists/admin/?page=import&tk=9be9df29f550da392f8b9d