Cloudflare WAF block, json issues

  • Resolved keengamer

    (@keengamer)


    5 years, 6 months ago

    As I said in another topic:

    First of all, the script you used to process the stories is blocked by cloudflare XSS, HTML Injection security, their firewall rule 100173. However, even if I disable it, I still get another error even when going to your dashboard. There is nothing else in the console.

    Unable to Load Stories
    The response is not a valid JSON response.

    But we use json and api for other services which work. I can see in the console that you try to load ALL??? users? We have over 2k users. You should be probably loading only those with rights to write posts.

    Anyway, right now it’s not working at all.

Viewing 15 replies - 1 through 15 (of 19 total)
1 2
  • Plugin Author Pascal Birchler

    (@swissspidy)

    5 years, 6 months ago

    Hi there,

    Thanks for your report!

    The Web Stories WordPress plugin generates HTML and sends that via the REST API, so it’s possible that the WAF mistakenly flags it for XSS. If you can disable that rule specifically for web-story endpoints that sure work.

    As for the dashboard, can you look at the Network tab and filter by XHR requests to see what their responses are? If there’s something messing up the responses, it won’t be valid JSON anymore and result in that error message.

    Example:

    Good point regarding the users, I just opened https://github.com/google/web-stories-wp/issues/4753 to investigate this. There’s definitely room for improvement!

    Thread Starter keengamer

    (@keengamer)

    5 years, 6 months ago

    The issue is still the way you work. Cloudflare blocks you, Sucuri blocks you. And we will surely NOT disable our protection just because of your plugin. This way you handle the processes is very, very bad.

    Cloudflare blocks you twice:
    1)
    Rule ID
    OWASP Block (981176)
    Rule message
    Inbound Anomaly Score Exceeded (Total Score: 133, SQLi=13, XSS=90)

    2)
    Rule ID
    100173
    Rule message
    XSS, HTML Injection – Script Tag
    Rule group
    Cloudflare Specials

    And no, it is not possible to exclude the URL or whatever because those rules have the priority. And well, Cloudflare is used A LOT so your plugin will not work for A HUGE amount of sites…

    If I disabled those protections, stories were saved and were working probably fine. But that is not the way we are willing to go…

    • This reply was modified 5 years, 6 months ago by keengamer.
    Plugin Author Pascal Birchler

    (@swissspidy)

    5 years, 6 months ago

    Thanks a lot for your help in debugging this issue with me and verifying the conflict and a potential workaround.

    I appreciate you sharing this concern with us and absoluetely understand that you don’t want to risk your site‘s security.

    We‘ll look into this further to determine how the plugin can operate with its full set of capabilities in such an environment, and will happily keep you posted on any updates in this regard.

    Thanks again for your help!

    toremo

    (@toremo)

    5 years, 6 months ago

    We can verify the problem and it is actually a serious one as like @keengamer already mentioned disabling the security we have in place is not the way we would go either as it would bring all our customers sites at risk. We actually have all sites running via Cloudflare and all external support requests we deal with are for 95% free Cloudflare – so getting your plugin not blocked by Cloudflare is a clear MUST HAVE, the same applies to Sucuri which is the most used security plugin too.

    Plugin Author Pascal Birchler

    (@swissspidy)

    5 years, 6 months ago

    Thanks for chiming in!

    We’re still looking into this and hope to be able to provide an update soon.

    Plugin Author Pascal Birchler

    (@swissspidy)

    5 years, 6 months ago

    Hi @keengamer and @toremo!

    In the new version 1.1.0 of the plugin we’ve included an experimental solution for this issue that allows you to keep using the plugin while still being fully protected by Cloudflare and Sucuri.

    Because it’s still experimental, it takes a couple of steps to enable this:

    1. Add define( 'WEBSTORIES_DEV_MODE', true ); to your **wp-config.php** file
    (somewhere before the /* That's all, stop editing! Happy publishing. */) line)
    2. In your WordPress admin, go to **Stories** -> **Experiments**
    3. Toggle the **WAF Compatibility** checkbox and save the changes.
    4. Create a new story!

    Could you try this and let us know if this works for you?

    Meanwhile, we’re working hard on stabilizing this feature in time for our 1.2.0 release so you don’t have to do these steps anymore.

    Thanks for your cooperation and patience!

    Thread Starter keengamer

    (@keengamer)

    5 years, 6 months ago

    Hello,

    this solution works, thanks.

    One more thing. It’s pretty bad that if we go to settings, my stories or whatever else except the editor, you hide the left main menu. We have it expanded as a default view and you change it without any need. I understand the reason to hide it in the editor to have more space but it should not be done outside of the editor…

    K.

    Thread Starter keengamer

    (@keengamer)

    5 years, 6 months ago

    Well, no, it doesn’t work fully.

    I cannot delete the stories, see here https://imgur.com/a/pIqDrZA It tries to load all the time some scripts which are blocked.

    Even in the editor I can see in the console:

    Uncaught TypeError: Cannot read property ‘addEventListener’ of null
    at wpr-cpcss.js?ver=3.7.4:10
    (anonymous) @ wpr-cpcss.js?ver=3.7.4:10

    I cannot even switch it to draft in the editor, again, it’s not possible to save the story.

    So I was able to create a new story but I cannot change it, I cannot delete the stories etc. So the plugin is still not usable at all.

    Plugin Author Pascal Birchler

    (@swissspidy)

    5 years, 6 months ago

    Glad to hear it’s working! I’ll mark this topic as resolved for now.

    Also, great suggestion. Agreed that it’s confusing. I’ve opened a ticket to address this for our next release.

    Please let us know if there’s anything else we can help with.

    Plugin Author Pascal Birchler

    (@swissspidy)

    5 years, 6 months ago

    Whoops! We posted at the same time!

    Thanks for the screenshot. I’ll be looking into this further then!

    Plugin Author Pascal Birchler

    (@swissspidy)

    5 years, 6 months ago

    (Note that wpr-cpcss is a WP-Rocket script. You should report that particular issue to WP-Rocket)

    Thread Starter keengamer

    (@keengamer)

    5 years, 6 months ago

    Well, could be. But then it’s probably incompatible with your plugin and WP Rocket is used as hell. So I think you should get in touch with them to make it both compatible ;-). Otherwise you will loose a lot of customers anyway.

    Plugin Author Pascal Birchler

    (@swissspidy)

    5 years, 6 months ago

    No need to worry, we’re already doing that 🙂 In fact, WP-Rocket is already working on improving support in their next version. But I still recommend reporting this to them as it might be particular to your setup.

    Thread Starter keengamer

    (@keengamer)

    5 years, 6 months ago

    I did…

    Thread Starter keengamer

    (@keengamer)

    5 years, 5 months ago

    So it is still not fixed. Most probably I had my IP whitelisted. However, one of our editors just tried to make a story and got rejected by cloudflare again.

    Service
    WAF
    Rule ID
    OWASP Block (981176)
    Rule message
    Inbound Anomaly Score Exceeded (Total Score: 28, SQLi=3, XSS=15)
    Rule group
    OWASP Inbound Blocking

    981231 · SQL Comment Sequence Detected OWASP SQL Injection Attacks Log WAF
    981245 · Detects basic SQL authentication bypass attempts 2/3 OWASP SQL Injection Attacks Log WAF
    uri-981173 · Restricted SQL Character Anomaly Detection Alert – Total # of special characters exceeded OWASP Uri SQL Injection Attacks Log WAF
    973338 · XSS Filter – Category 3: Javascript URI Vector OWASP XSS Attacks Log WAF
    973300 · Possible XSS Attack Detected – HTML Tag Handler OWASP XSS Attacks Log WAF
    973306 · XSS Attack Detected OWASP XSS Attacks Log WAF

    Score is not now 133 but still 28 gets caught by the filter again. We cannot really disable it, just yesterday we were attacked from Russia a lot so this must be solved on your end. In my opinion you just work around the wordpress core and are very aggressive in creating and saving the content which is simply not working well…

    • This reply was modified 5 years, 5 months ago by keengamer.
    • This reply was modified 5 years, 5 months ago by keengamer.
Viewing 15 replies - 1 through 15 (of 19 total)
1 2

The topic ‘Cloudflare WAF block, json issues’ is closed to new replies.