NO BUG: IP blocked by server due to code execution

Bugs
1

Hi bricks team,

I sent this report to the support email yesterday, but since it’s an emergency, I decided to share it on the forum to see if there are any similar cases.

The problem is that the server blocks foreign IPs under certain circumstances due to security issues. Since some colleagues from abroad access the site to produce content on the website, their IPs are constantly blocked. I shared this with the hosting and they sent the blocks log and it seems to be something related to bricks.

Message: Access denied with code 403 (phase 2). Match of "streq IR" against "GEO:COUNTRY_CODE" required. [file "/usr/local/waf_rules/20_apps_wp_plugin.conf"] [line "3149"] [id "8990260"] [rev "1"] [msg "Bricks <= 1.9.6 - Unauthenticated Remote Code Execution"]
Apache-Error: [file "apache2_util.c"] [line 275] [level 3] [client (user ip)] ModSecurity: Access denied with code 403 (phase 2). Match of "streq IR" against "GEO:COUNTRY_CODE" required. [file "/usr/local/waf_rules/20_apps_wp_plugin.conf"] [line "3149"] [id "8990260"] [rev "1"] [msg "Bricks <= 1.9.6 - Unauthenticated Remote Code Execution"] [hostname "domain.com"] [uri "/wp-json/bricks/v1/load_query_page"] [unique_id "id code"]

Thank you in advance for any guidance.

2

Hi @HOSEIN ,

As per my email reply, there is no code/logic inside Bricks to block requests.

It should be related to your server/proxy firewall rules.

Regards,
Jenn

1 Like
4

Hi @HOSEIN,

To provide more context: this isn’t a Bricks issue. The 403 is coming from your host’s ModSecurity firewall, which is blocking requests based on an outdated rule targeting Bricks <= 1.9.6 due to a past RCE vulnerability.

As long as you’re running Bricks 1.9.6.1 (which came out over a year ago) or later, you’re not affected by that vulnerability, and the rule (ID 8990260) is producing a false positive. You’ll need to ask your host to disable or adjust that rule. This is entirely a firewall config issue on the host’s side.

2 Likes
5

Hi @itchycode and @charaf,

Thank you for your excellent response and guidance. I will forward your response to the hosting.

Thanks again