[BUG] BLACKLIST_URI_URLS not blocking URI's

[zynexiz]

What happened?

The usage of BLACKLIST_URI_URLS don't seem to block the URI entered for the site. I'm not sure if I misunderstand the purpose, or if this is a bug I have the setting BLACKLIST_URI_URLS=https://cloud.mydomain.se/index.php/login?direct=1 for NextCloud, which should block the access to the default login page for NextCloud. We need this because we have Keycloak IDP that should be used. The problem is that is that link is still accessible for the outside world, an adversary can potentially bypass the IDP and login using a leaked password without MFA thru our federated login.

NextCloud itself don't seem to have a way to block it, and it's still needed for "break the glass" account, so it should be accessible within a certain white lite IP range.

I have tried both BLACKLIST_URI and BLACKLIST_URI_URLS without success. There was some config examples with BLACKLIST_IP_URLS, but that doesn't seem to exist (maybe old example that doesn't work anymore?).

How to reproduce?

Create a BLACKLIST_URI_URLS setting and test it.

Configuration file(s) (yaml or .env)

IS_DRAFT=no
SERVER_NAME=cloud.mydomain.se
USE_TEMPLATE=low
BAD_BEHAVIOR_THRESHOLD=30
BAD_BEHAVIOR_BAN_TIME=10800
BLACKLIST_COMMUNITY_LISTS=ip:danmeuk-tor-exit ua:mitchellkrogza-bad-user-agents ip:laurent-minne-data-shield-aggressive ip:laurent-minne-data-shield-critical
BLACKLIST_URI_URLS=https://cloud.mydomain.se/index.php/login?direct=1
USE_BROTLI=yes
USE_CLIENT_CACHE=yes
USE_CORS=yes
CORS_ALLOW_ORIGIN=*
CORS_ALLOW_METHODS=GET, POST, PUT, DELETE, OPTIONS, PROPFIND, REPORT, MKCOL, COPY, MOVE, LOCK, UNLOCK
CORS_ALLOW_HEADERS=DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
CORS_ALLOW_CREDENTIALS=yes
CROSS_ORIGIN_RESOURCE_POLICY=same-origin
CORS_DENY_REQUEST=no
WHITELIST_COUNTRY=SE
USE_GZIP=yes
GZIP_PROXIED=expired no-cache no-store private auth
KEEP_UPSTREAM_HEADERS=*
CONTENT_SECURITY_POLICY=default-src 'self'; style-src 'self' 'unsafe-inline' https:; script-src 'self' 'unsafe-eval' 'unsafe-inline' https:; font-src 'self' data:; img-src 'self' data: blob:; connect-src 'self' wss:; frame-src 'self';
REFERRER_POLICY=no-referrer
PERMISSIONS_POLICY=
X_CONTENT_TYPE_OPTIONS=
COOKIE_FLAGS=\* SameSite=Lax
AUTO_LETS_ENCRYPT=yes
EMAIL_LETS_ENCRYPT=support@mydomain.se
USE_LIMIT_REQ=no
USE_LIMIT_CONN=no
LIMIT_CONN_MAX_HTTP1=25
LIMIT_CONN_MAX_HTTP2=200
LIMIT_CONN_MAX_HTTP3=200
LIMIT_REQ_RATE=20r/s
LIMIT_REQ_URL_1=/apps
LIMIT_REQ_RATE_1=5r/s
LIMIT_REQ_URL_2=/apps/text/session/sync
LIMIT_REQ_RATE_2=8r/s
LIMIT_REQ_URL_3=/core/preview
LIMIT_REQ_RATE_3=5r/s
ALLOWED_METHODS=GET|POST|HEAD|COPY|DELETE|LOCK|MKCOL|MOVE|PROPFIND|PROPPATCH|PUT|UNLOCK|OPTIONS|REPORT
MAX_CLIENT_SIZE=10G
LISTEN_HTTP=no
MODSECURITY_CRS_PLUGINS=nextcloud-rule-exclusions
REMOTE_PHP_PORT=
USE_REAL_IP=yes
REAL_IP_FROM=10.x.x.x/22
USE_REVERSE_PROXY=yes
REVERSE_PROXY_INTERCEPT_ERRORS=no
USE_PROXY_CACHE=yes
PROXY_BUFFERS=16 512k
PROXY_BUFFER_SIZE=256k
PROXY_BUSY_BUFFERS_SIZE=1024k
REVERSE_PROXY_HOST=http://nextcloud # Load balancer
REVERSE_PROXY_WS=yes
USE_ROBOTSTXT=yes
ROBOTSTXT_COMMUNITY_LISTS=ai-robots-txt robots-disallowed
SELF_SIGNED_SSL_SUBJ=/CN=mydomain.se/
REDIRECT_HTTP_TO_HTTPS=yes
WHITELIST_RDNS=
WHITELIST_ASN=

Relevant log output

BunkerWeb version

1.6.10

What integration are you using?

Docker

Linux distribution (if applicable)

Debian 13

Removed private data

• I have removed all private data from the configuration file and the logs

Code of Conduct

• I agree to follow this project's Code of Conduct

[TheophileDiot]

Hi @zynexiz, we do have examples in the documentation, did you try them ?
https://docs.bunkerweb.io/latest/features/#__tabbed_9_2

[zynexiz]

Hi @zynexiz, we do have examples in the documentation, did you try them ? https://docs.bunkerweb.io/latest/features/#__tabbed_9_2

Yes, I looked at the docs for it. I have tried to use both BLACKLIST_URI=\?direct=1 and BLACKLIST_URI_URLS=https://cloud.mydomain.se/index.php/login?direct=1 without any success. I still allows the page to load (tried from my mobile outside our network to).

[EDIT] I tested the regex for BLACKLIST_URI=\?direct=1 with an online tool, and get match there.

[TheophileDiot]

Just so you know, this setting BLACKLIST_URI_URLS is to download the blacklist from a distant source (as explained in the documentation).

[zynexiz]

Just so you know, this setting BLACKLIST_URI_URLS is to download the blacklist from a distant source (as explained in the documentation).

Ah, didn't realise that. Must have missed that part.But the BLACKLIST_URI should be working as I think it does, block a certain page that is?

[TheophileDiot]

Indeed

[TheophileDiot]

Don't forget that this is a PCRE regex

[zynexiz]

The odd thing is that I have this rule for Keycloak for the master realm, and that works. There I have BLACKLIST_URI=/realms/master /admin/master/console/ and it blocks it as it should. But for Nextcloud I tested the same approach with BLACKLIST_URI=/index.php/login, and that don't work.

[TheophileDiot]

To block a path directly, use BLACKLIST_URI. It expects a space-separated list of PCRE patterns matched against the request URI, and each pattern must start with /, it's a path, not a full scheme+host URL. So drop the https://cloud.mydomain.se part:

USE_BLACKLIST=yes
BLACKLIST_URI=^/index\.php/login

Can you confirm whether BLACKLIST_URI=^/index\.php/login blocks the page as expected?

[zynexiz]

To block a path directly, use BLACKLIST_URI. It expects a space-separated list of PCRE patterns matched against the request URI, and each pattern must start with /, it's a path, not a full scheme+host URL. So drop the https://cloud.mydomain.se part:

USE_BLACKLIST=yes
BLACKLIST_URI=^/index.php/login

Can you confirm whether BLACKLIST_URI=^/index\.php/login blocks the page as expected?

The BLACKLIST_URI=^/index\.php/login did indeed work, but also blocked all login requests, even those tru our IDP. Think the redirect goes domain.se > domain.se/index.php/login > IDP, which means it will also block the IDP redirect. It's specifically ?direct=1 i need to block to prevent login thru Nextclouds own login system (hence bypassing the IDP).

The URL itself to that is https://cloud.domain.se/index.php/login?direct=1. I tried both BLACKLIST_URI=^/index\.php/login\?direct=1 and BLACKLIST_URI=^/index\.php/login?direct=1 (without \?).

[TheophileDiot]

Hi @zynexiz, this is because we do not support URL parameters in the URIs.
I guess we can ponder on it and let you know. This must likely transform into a feature request

[zynexiz]

Ah, that explains why I didn't get it to work. Thought it checked the entire URL for matches. Might be a good thing to add to maybe? :)

[zynexiz]

I close this issue due to not being a bug, might be a feature request? I didn't correctly get it to work as intended in BW, but solved it by adding relevant lines to the apache config for Nextcloud instead.