How do I unblock a request uri in Modsecurity CRS?

Question

I have installed a Nginx WAF with Modsecurity CRS. This WAF protects a backend WordPress.

One request from one of the plugins generated a false positive on the Modsecurity with the rule id 933120.

I identified it in the audit log, studied it, and created a exclusion rule as it follows:

SecRule REQUEST_URI "@beginsWith /wp-admin/admin.php?page=wp-mail-smtp" \
    "id:1001,\
    phase:1,\
    pass,\
    nolog,\
    ctl:ruleRemoveTargetById=933120;ARGS:_wp_http_referer"

But as the score is now higher than the anomaly score threshold, I'm sill getting access denied for the request and I can see it in the logs:

2024/06/19 04:36:06 [error] 1071#1071: *553 [client x.x.x.x] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/modsecurity.d/owasp-crs-wordpress/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.2.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "x.x.x.x"] [uri "/wp-admin/admin.php"] [unique_id "171878256689.980974"] [ref ""], client: x.x.x.x, server: mydomain.com, request: "POST /wp-admin/admin.php?page=wp-mail-smtp-tools&tab=test HTTP/2.0", host: "mydomain.com", referrer: "https://mydomain.com/wp-admin/admin.php?page=wp-mail-smtp-tools"

How can I remove the url from the blacklist? Is there a way to reset the anomaly score for this url requests?

Answer 1

It turns out that I was making a mistake. The exclusion rule was right but the file REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf with my rule, was with the wrong ownership and the nginx was silent about it. After attributing the ownership of the file to the nginx user, the rule started to work and the problem was solved.