The ModSecurity module on the Apache server (BigMachines web server) is mandated for all upgrades starting with BigMachines version 11.
The solution is simple. Search for double pipes everywhere and replace them with another delimiter or in another way depending on how you use them.
Here is some information I received when this was discovered about ModSecurity in BigMachines on how to find the problem and how to correct it:
ModSecurity is an integrated module with Apache, the BigMachines web server. It is used to prevent attacks and malicious code, and it provides a great extra layer of security for the BigMachines platform. Being integrated with Apache, the security rules apply to all traffic through the web server. You can find more information at http://www.modsecurity.org.
If you get an HTTP 400 error or an HTTP 501, it is very likely that you have run into a ModSecurity violation.
Investigation tip: To help identify if a string is causing a modsecurity fault, type it into the global search results box and hit search. If your string is the culprit, you will get the error there.
This is generally how the error will look:
Bad Request
Your browser sent a request that this server could not understand.
*This is the HTTP 400 Error
Method Not Implemented
POST to /admin/scripts/search_script.jsp not supported.
*This is the HTTP 501 Error
Common ModSecurity Violations
Use of character string “||”
(“||” like SQL injection attack)
Causes an HTTP 400 Error You may not pass a double pipe through the server. This includes outputs from rules such as string delimiters, sending or receiving information from anyplace such as the resources server, and even end user inputs such as Configuration and Commerce fields. The double pipe is dangerous enough that it is tightly blocked by ModSecurity, and care needs to be taken that it is simply not used. When troubleshooting this ModSecurity violation, you will not be able to do a ‘Global Search on BML’, because even passing it into this field causes an HTML 400 error. You will need to do a bulk download of the different BML areas and search for the double pipe using an external program. You also need to check your CSS, JavaScript, and any other fancy workarounds that you may have come up with.
*NOTE: the ModSecurity rule is looking for [%]7C [%]7C (where %7C is the hex for a pipe), keep this in mind when searching.
Use of character string “|nc “, “|ps “, “|id ” or others
(“|” followed by certain linux commands and a blank)
Causes an HTTP 501 Error The same restrictions as the above “double pipe” rule apply to the “|nc” rule.
The “nc” pattern matches a linux command, so ModSecurity perceives it as a system attack and will try to block it. As with the double pipe rule, the way to fix this is to replace it, and you will not be able to search for it using Global Search on BML.
Use of character string “%00″
Causes an HTTP 400 Error Same restrictions as double-pipe. “%00″ is a null byte, with which attackers can make part of the system think a string is over, and thus quit analyzing for security. Customer data could start with 00, so you should not use anything ending in % as a delimiter.