I have httpd running on RHEL8 with a single server hosting multiple different sites related to the same codebase. It hosts our primary site that contains code from the master branch. It also hosts developer sites as subdomains and servers review apps as well. Because we use a single wildcard cert for essentially our entire organization, the developer and review app sites are currently not served over https.

I recently found during some testing (http) of a page that POSTs free text entered by the user that the request was failing with net::ERR_CONNECTION_RESET in the browser console. The key here is that the request had to contain a very specific payload. It is submitted with x-www-form-urlencoded and the un-encoded content is <p>;ls</p>. The full raw payload is thus prov_comm_notes=%3Cp%3E%3Bls%3C%2Fp%3E. I was unable to find anything in the server logs at all. Nothing in httpd or php-fpm. The request was never even starting up a php process. Through a series of events I decided to try the page from https even though our cert isn’t valid for the subdomain and ,lo and behold, the POST worked! I was not able to reproduce this from our production, test, or primary development instances as they all are served over https.

What could be causing this? My thinking is that it has to be something with httpd (or even firewalld?) that is inspecting the request’s payload and stopping it. Only thing I can guess is that the presence of the OS command ls is not passing some check. Oddly, I tried many other OS commands in the payload and was unable to find another combination that caused a failure. Open to all suggestions to check. Thanks!