This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Encoded URI being broken by WAF

Hello we have a web application being published through UTM. Im facing the below error while try to access the page thorugh the firewall. It seems to decode a URI in the request which is messing up the request. How can I override this. Please see the log below.

httpd[23242]: [core:notice] [pid 23242:tid 4121860976] [client 86.98.77.5:50008] AH00026: found %2f (encoded '/') in URI (decoded='/sap/opu/odata/UI2/PAGE_BUILDER_PERS/PageSets('/UI2/Fiori2LaunchpadHome')'), returning 404, referer: http://ourdomain/sap/bc/ui5_ui5/ui2/ushell/shells/abap/Fiorilaunchpad.html

Please help.

This thread was automatically locked due to age.

Parents

0 Benjamin Hecht over 7 years ago

Hello

we have the same problem with our gitlab server.

2017:08:31-09:05:04 httpd[28330]: [core:notice] [pid 28330:tid 2938100592] [client 10.0.254.240:51432] AH00026: found %2f (encoded '/') in URI (decoded='/CB/bsp/network/feature/core'), returning 404, referer: https://ourdomain/CB/bsp/network/develop

In the apache there is a AllowEncodedSlashes directive.

But I did not found anything in the Sophos UTM.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Benjamin Hecht over 7 years ago

Hello

we have the same problem with our gitlab server.

2017:08:31-09:05:04 httpd[28330]: [core:notice] [pid 28330:tid 2938100592] [client 10.0.254.240:51432] AH00026: found %2f (encoded '/') in URI (decoded='/CB/bsp/network/feature/core'), returning 404, referer: https://ourdomain/CB/bsp/network/develop

In the apache there is a AllowEncodedSlashes directive.

But I did not found anything in the Sophos UTM.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Lutz Fiekens over 6 years ago in reply to Benjamin Hecht

Hi, did you ever find a solution for this? I've the same problem with SAP Fiori Launchpad!
Cancel
Vote Up 0 Vote Down

Cancel
0 Benjamin Hecht over 6 years ago in reply to Lutz Fiekens
Yes, I found a solution.
You must add some settings to the apache config.

/var/storage/chroot-reverseproxy/usr/apache/conf/waf/base.conf

Add here this line

AllowEncodedSlashes ON

Then restart the Proxy

/var/mdw/scripts/reverseproxy restart

This change is for all proxy settings.

You can add the line also to one configuration but after a restart or a change you must add it again.

/var/storage/chroot-reverseproxy/usr/apache/conf

Regards
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 6 years ago in reply to Benjamin Hecht

Thanks, Benjamin and welcome to the UTM Community!

It's always great to see a first post be something that helps the rest of us!

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Mohammed Riaz over 6 years ago in reply to Benjamin Hecht

Thanks Ben

I had moved this service to another firewall as it was not fixed on this. I will test it out here again and let you know
Cancel
Vote Up 0 Vote Down

Cancel
0 Rembik Rain over 4 years ago in reply to Benjamin Hecht

For another workaround of this missing configuration option see: https://community.sophos.com/products/unified-threat-management/f/general-discussion/92242/utm-9-reverse-proxy-configuration/436406#pi2353filter=answers&pi2353scroll=false
Cancel
Vote Up 0 Vote Down

Cancel