Repository navigation
Rules with both chain and multiMatch may produce excess writes to audit log #2672
Description
If a chained rule has at least one rule that includes the multiMatch action and the rule with the multiMatch action is not the final rule in the chain, then writes to the audit log may occur even if not all rules within the chain resulted in a match.
For example, with SecAuditEngine RelevantOnly and the following chained rule:
SecRule ARGS "@contains y0" "id:1001,phase:2,t:urlDecode,t:lowercase,multimatch,log,deny,status:403,chain"
SecRule ARGS "@contains y1" "t:none"
In this case, if only the first rule of the two-rule chain matches, as in this request
and with this request: curl http://localhost/testget.php?a=y0
... then a write to the audit log can still occur.
The transaction is (correctly) not denied, and no other ill effects have been observed.
This has been confirmed to be longstanding behaviour in ModSecurity v3 (at least as far back as v3.0.3) rather than a regression.
Activity
ssigwart commentedon Apr 3, 2024
I think this issue affects rule 942131 of the OWASP CRS:
https://github.com/coreruleset/coreruleset/blob/9875b44c0b9d91144d02df78af8e056d96ce0ffb/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf#L722-L746
1 is not 1triggers the first rule, but not the second. However, it still gets logged (if using blocking_paranoia_level 2).fzipi commentedon Oct 12, 2026
Revisiting this one, and confirming it still reproduces on current
v3/master. WithSecAuditEngine RelevantOnly,SecAuditLogRelevantStatus "^(?:5|4)"and the two-rule chain from the description, a request matching only the first rule (/?a=y0):multimatchon the chain starter: "Saving this request as part of the audit logs" (status 200, not denied);multimatch: "Return code 200 is not interesting to audit logs".So the
logof a chain starter withmultiMatchmarks the transaction as relevant before the chain has completed. The 2023 multiMatch fixes (#2866, #2868) did not cover this path. As @ssigwart noted, CRS rule 942131 hits it. Marking as a confirmed bug.