{"action":"created","issue":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/1202","repository_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs","labels_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/1202/labels{/name}","comments_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/1202/comments","events_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/1202/events","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1202","id":368186297,"node_id":"MDU6SXNzdWUzNjgxODYyOTc=","number":1202,"title":"Rule Question","user":{"login":"Dhariaj","id":38356060,"node_id":"MDQ6VXNlcjM4MzU2MDYw","avatar_url":"https://avatars3.githubusercontent.com/u/38356060?v=4","gravatar_id":"","url":"https://api.github.com/users/Dhariaj","html_url":"https://github.com/Dhariaj","followers_url":"https://api.github.com/users/Dhariaj/followers","following_url":"https://api.github.com/users/Dhariaj/following{/other_user}","gists_url":"https://api.github.com/users/Dhariaj/gists{/gist_id}","starred_url":"https://api.github.com/users/Dhariaj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Dhariaj/subscriptions","organizations_url":"https://api.github.com/users/Dhariaj/orgs","repos_url":"https://api.github.com/users/Dhariaj/repos","events_url":"https://api.github.com/users/Dhariaj/events{/privacy}","received_events_url":"https://api.github.com/users/Dhariaj/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-10-09T12:30:33Z","updated_at":"2018-10-09T13:02:00Z","closed_at":"2018-10-09T13:02:00Z","author_association":"NONE","body":"<!--- For help and support please go to Stack Exchange: -->\r\n<!--- https://security.stackexchange.com/questions/tagged/owasp-crs -->\r\n\r\n<!--- Provide a general summary of the issue in the Title above -->\r\n\r\n## Type of Issue\r\nIssue with the rule \r\n![image](https://user-images.githubusercontent.com/38356060/46669391-4a339a80-cb9d-11e8-9560-ae4503339cd8.png)\r\n<!-- Incorrect blocking (false positive), incorrect bypass (false negative), -->\r\n<!-- bug fix, feature suggestion -->\r\n\r\n## Description\r\nWe are using modsecurity rules as part of the NGINX plus configuration and yesterday and one of our vendors was having some issues getting their requests through.  After sniffing through the logs we found out that the following rule was getting triggered every time they would send a request\r\n \r\nSecRule REQBODY_ERROR \"!@eq 0\" \\\r\n\"id:'200002', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2\"\r\n \r\nAnd if you look at the audit logs it gives us the following information\r\n \r\n---kMQLOcON---H--\r\nModSecurity: Access denied with code 400 (phase 2). Matched \"Operator `Eq' with parameter `0' against variable `REQBODY_ERROR' (Value: `1' ) [file \"/etc/nginx/modsec/modsecurity.conf\"] [line \"44\"] [id \"200002\"] [rev \"\"] [msg \"Failed to parse request body.\"] [data \"JSON parsing error: parse error: premature EOF\\x0a\"] [severity \"2\"] [ver \"\"] [maturity \"0\"] [accuracy \"0\"] [hostname \"x.x.x.x\"] [uri \"/v1/members/xxxxxx/xxxx-details\"] [unique_id \"153901811455.132212\"] [ref \"v1591,1\"]\r\n \r\nSomething similar has been explained out here https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/271 and I am still researching on a solution but I dont see a solution. Was wondering if anyone has faced something like this and were able to resolve the issue?\r\n<!-- In case of a false positive, please provide a copy of the audit -->\r\n<!-- log entry. You can usually find this at /var/log/modsec_audit.log. -->\r\n<!-- In case of a false negative, please provide the payload you -->\r\n<!-- are sending. For complex payloads with headers, please include -->\r\n<!-- a curl command. -->\r\n<!-- Include any relevant CVEs or research links. -->\r\n\r\n## Your Environment\r\n<!--- Include as many relevant details about the environment you -->\r\n<!--- experienced the bug in: -->\r\n* modsecurity-crs-3.0.2\r\n\r\n*nginx version: nginx/1.15.2 (nginx-plus-r16)\r\n\r\n## Confirmation\r\n\r\n[ ] I have removed any personal data (email addresses, IP addresses,\r\n    passwords, domain names) from any logs posted.\r\n"},"comment":{"url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/comments/428182786","html_url":"https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1202#issuecomment-428182786","issue_url":"https://api.github.com/repos/SpiderLabs/owasp-modsecurity-crs/issues/1202","id":428182786,"node_id":"MDEyOklzc3VlQ29tbWVudDQyODE4Mjc4Ng==","user":{"login":"dune73","id":618722,"node_id":"MDQ6VXNlcjYxODcyMg==","avatar_url":"https://avatars3.githubusercontent.com/u/618722?v=4","gravatar_id":"","url":"https://api.github.com/users/dune73","html_url":"https://github.com/dune73","followers_url":"https://api.github.com/users/dune73/followers","following_url":"https://api.github.com/users/dune73/following{/other_user}","gists_url":"https://api.github.com/users/dune73/gists{/gist_id}","starred_url":"https://api.github.com/users/dune73/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dune73/subscriptions","organizations_url":"https://api.github.com/users/dune73/orgs","repos_url":"https://api.github.com/users/dune73/repos","events_url":"https://api.github.com/users/dune73/events{/privacy}","received_events_url":"https://api.github.com/users/dune73/received_events","type":"User","site_admin":false},"created_at":"2018-10-09T13:02:00Z","updated_at":"2018-10-09T13:02:00Z","author_association":"COLLABORATOR","body":"Rule 200002 is a rule that comes together with a very small group of recommended rules distributed with ModSecurity.\r\n\r\n-> https://github.com/SpiderLabs/ModSecurity/blob/v2/master/modsecurity.conf-recommended\r\n\r\nSorry for the inconvenience.\r\n\r\nI'm closing this now."}}
{"actor":{"display_login":"dune73"}}