Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug: "ip-block-list - snort.org" feed failing with 403 errors #9707

Open
1 task done
chennin7 opened this issue Apr 24, 2024 · 1 comment
Open
1 task done

Bug: "ip-block-list - snort.org" feed failing with 403 errors #9707

chennin7 opened this issue Apr 24, 2024 · 1 comment
Labels
needs triage This issue has been automatically labelled and needs further triage

Comments

@chennin7
Copy link

Actual behavior

We're getting 403 errors when we attempt to fetch attributes from the "ip-block-list - snort.org". We were successfully pulling this feed, but seemingly out of nowhere this started happening. Interestingly if we do a wget https://snort.org/downloads/ip-block-list on the server, it can pull the file with no issues.

See full error message below.

Expected behavior

We expect to be able to retrieve attributes from the feed without errors.

Steps to reproduce

Fetch attributes from the "ip-block-list - snort.org" default feed. This fails with triggering in the web application and via the CLI.

Version

2.4.190

Operating System

RedHat

Operating System version

7.9

PHP version

7.4.33

Browser

No response

Browser version

No response

Relevant log output

2024-04-24 15:50:06 Error: Could not get freetext feed 9
[HttpSocketHttpException] Remote server returns HTTP error code 403 for URL https://snort.org/downloads/ip-block-list: <!DOCTYPE html>
<!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->
<!--[if I
Stack Trace:
#0 /var/www/MISP/app/Model/Feed.php(343): Feed->feedGetUriRemote()
#1 /var/www/MISP/app/Model/Feed.php(382): Feed->getFreetextFeedRemote()
#2 /var/www/MISP/app/Model/Feed.php(1229): Feed->getFreetextFeed()
#3 /var/www/MISP/app/Console/Command/ServerShell.php(411): Feed->downloadFromFeedInitiator()
#4 /var/www/MISP/app/Lib/cakephp/lib/Cake/Console/Shell.php(459): ServerShell->fetchFeed()
#5 /var/www/MISP/app/Lib/cakephp/lib/Cake/Console/ShellDispatcher.php(222): Shell->runCommand()
#6 /var/www/MISP/app/Lib/cakephp/lib/Cake/Console/ShellDispatcher.php(66): ShellDispatcher->dispatch()
#7 /var/www/MISP/app/Console/cake.php(45): ShellDispatcher::run()
#8 {main}
Job failed.

Extra attachments

No response

Code of Conduct

  • I agree to follow this project's Code of Conduct
@chennin7 chennin7 added the needs triage This issue has been automatically labelled and needs further triage label Apr 24, 2024
@vercheck
Copy link

vercheck commented May 21, 2024 •
edited

Yep, observed the same with snort and a couple of other txt feeds, in Ubuntu based MISP. The URL actually redirects to something like https://snort-org-site.s3.amazonaws.com/production/document_files/files/000/030/929/original/ip-filter.blf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAU7AK5ITMMOXGB2W5%2F20240523%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240523T091133Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=920528cee70eee181c1233170068a62a49fae18be6b6c36a7f3c33fa157d0c6c

And this is probably the reason for seeing this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
needs triage This issue has been automatically labelled and needs further triage
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@chennin7 @vercheck