Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 14488 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

/owa/redir.aspx Forbidden

filippb
When using exchnage  OWA with Webserver Protection URLs within an email can not be clicked on. you get the following error
You don't have permission to access /owa/redir.aspx on this server.

adding /owa/redir.aspx* into exception does not solve the problem.

any suggestion?

thanks


This thread was automatically locked due to age.
  • 0
    What do you see in the Web Application Firewall log file that might shed more light on this?  Also, try #1 in Rulz.

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    I had the same issue, I looked in the WAF firewall and found the following lines, I added the ID's 950120  981176 as skipped rules on the Exchange OWA firewall profile I had configured and this worked.



    015:04:09-09:04:01 sslvpn reverseproxy: [Thu Apr 09 09:04:01.916152 2015] [security2:error] [pid 14125:tid 3912117104] [client ***xx] ModSecurity: Warning. Match of "beginsWith %{request_headers.host}" against "TX:1" required. [file "/usr/apache/conf/waf/modsecurity_crs_generic_attacks.conf"] [line "163"] [id "950120"] [rev "3"] [msg "Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link"] [data "Matched Data: Australian Breaking News Headlines & World News Online | SMH.com.au found within TX:1: www.smh.com.au"] [severity "CRITICAL"] [ver "OWASP_CRS/2.2.7"] [maturity "9"] [accuracy "9"] [tag "OWASP_CRS/WEB_ATTACK/RFI"] [hostname "******"] [uri "/owa/redir.aspx"] [unique_id "VSWz4aw***xxfQAAABa"] 
    2015:04:09-09:04:01 sslvpn reverseproxy: [Thu Apr 09 09:04:01.916493 2015] [security2:error] [pid 14125:tid 3912117104] [client 202.9.87.20] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(.*)" at TX:950120-OWASP_CRS/WEB_ATTACK/RFI-TX:1. [file "/usr/apache/conf/waf/modsecurity_crs_inbound_blocking.conf"] [line "26"] [id "981176"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5, SQLi=, XSS=): Last Matched Message: Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference/Link"] [data "Last Matched Data: www.smh.com.au"] [hostname "*********"] [uri "/owa/redir.aspx"] [unique_id "VSWz*********QAAABa"]
Unfiltered HTML