Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Mac ownCloud desktop client and Calendar.app over privacy VPN

See original GitHub issue

Description

Originally filed as owncloud/core#39109.

Audit Logs / Triggered Rule Numbers

[Thu Aug 12 01:42:04.791801 2021] [:error] [pid 735:tid 4087120979712] [client ….….….…:43070] [client ….….….…] ModSecurity: Warning. Pattern match "(?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)\\\\s+(?:\\\\/|\\\\w)[^\\\\s]*(?:\\\\s+http\\\\/\\\\d|[\\\\r\\\\n])" at REQUEST_BODY. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "52"] [id "921110"] [msg "HTTP Request Smuggling Attack"] [data "Matched Data: propfind xmlns:d=\\x22dav:\\x22>\\x0a found within REQUEST_BODY: <?xml version=\\x221.0\\x22 ?>\\x0a<d:propfind xmlns:d=\\x22dav:\\x22>\\x0a  <d:prop>\\x0a    <d:getlastmodified />\\x0a  </d:prop>\\x0a</d:propfind>\\x0a"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272/220/33"] [hostname "…"] [uri "/remote.php/webdav/"] [unique_id "…"]
[Thu Aug 12 01:42:04.795182 2021] [:error] [pid 735:tid 4087120979712] [client ….….….…:43070] [client ….….….…] ModSecurity: Access denied with code 418 (phase 2). Operator GE matched 7 at TX:anomaly_score. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "…"] [uri "/remote.php/webdav/"] [unique_id "…"]

[Fri Aug 13 01:48:07.565414 2021] [:error] [pid 15257:tid 4087120979712] [client ….….….…:22550] [client ….….….…] ModSecurity: Warning. Pattern match "(?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)\\\\s+(?:\\\\/|\\\\w)[^\\\\s]*(?:\\\\s+http\\\\/\\\\d|[\\\\r\\\\n])" at REQUEST_BODY. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "52"] [id "921110"] [msg "HTTP Request Smuggling Attack"] [data "Matched Data: propfind xmlns:a=\\x22dav:\\x22>\\x0a found within REQUEST_BODY: <?xml version=\\x221.0\\x22 encoding=\\x22utf-8\\x22?>\\x0a<a:propfind xmlns:a=\\x22dav:\\x22>\\x0a  <a:prop>\\x0a    <b:calendar-home-set xmlns:b=\\x22urn:ietf:params:xml:ns:caldav\\x22/>\\x0a    <b:calendar-user-address-set xmlns:b=\\x22urn:ietf:params:xml:ns:caldav\\x22/>\\x0a    <a:current-user-principal/>\\x0a    <a:displayname/>\\x0a    <c:dropbox-home-url xmlns:c=\\x22http://calendarserver.org/ns/\\x22/>\\x0a    <c:email-address-set xmlns:c=\\..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia- [hostname "…"] [uri "/remote.php/dav/"] [unique_id "…"]
[Fri Aug 13 01:48:07.570392 2021] [:error] [pid 15257:tid 4087120979712] [client ….….….…:22550] [client ….….….…] ModSecurity: Access denied with code 418 (phase 2). Operator GE matched 7 at TX:anomaly_score. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "…"] [uri "/remote.php/dav/"] [unique_id "…"]