ModSecurity SecRule to exclude an URL from any check

Question

ModSecurity has a false positive trying to open the url: https://www.galgani.it/solitudine-contesti-virtuali-internet-facebook-social-network-smartphone/solitudine-e-contesti-virtuali.html

It returs a 403 error.

It's only a simple static html page without javascript or dynamic code.

ModSecurity works fine for my other pages. In the /etc/modsecurity/modsecurity.conf, which rule can I add to whitelist (or exclude) that specific url?

The error is:

[Fri Mar 27 14:54:50.189006 2020] [:error] [pid 10566:tid 140214542481152] [client 91.252.113.190:26752] [client 91.252.113.190] ModSecurity: Warning. Operator GE matched 4 at TX:outbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "82"] [id "980140"] [msg "Outbound Anomaly Score Exceeded (score 4): PHP source code leakage"] [tag "event-correlation"] [hostname "www.galgani.it"] [uri "/solitudine-contesti-virtuali-internet-facebook-social-network-smartphone/solitudine-e-contesti-virtuali.html"] [unique_id "Xn4FqfNLERK@02hvkdmOogAAAFI"]

Answer 1

Solved! The rule to be inserted in /etc/modsecurity/modsecurity.conf, to whitelist that specific URL, is:

SecRule REQUEST_FILENAME "@streq /solitudine-contesti-virtuali-internet-facebook-social-network-smartphone/solitudine-e-contesti-virtuali.html" "id:1,phase:2,nolog,allow,ctl:ruleEngine=Off"