Deny all the POST request

[wangxianwei]

Hi,

I have installed the modseurity in the nginx. I find that all the post request have been denied. but not denied the get request. I don't know where i make a error configure. thank you.

Regards,
Owen

[csanders-git]

Did you add any rules? If so would it be possible to see which rules you added?

[wangxianwei]

No, I have close any rules. please see the audit log when i use the Fiddler to sent a post reqest.

[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Initialising transaction (txid ucAcAwBcBvAMAcmcAcAsAcAc).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Transaction context created (dcfg 340d1d8).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Starting phase REQUEST_HEADERS.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] This phase consists of 2 rule(s).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Recipe: Invoking rule 362b368; [file "/app/soft/nginx/conf/modsecurity.conf"] [line "28"] [id "200000"].
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][5] Rule 362b368: SecRule "REQUEST_HEADERS:Content-Type" "@rx text/xml" "phase:1,auditlog,id:200000,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Rule returned 0.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] No match, not chained -> mode NEXT_RULE.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Recipe: Invoking rule 362cf58; [file "/app/soft/nginx/conf/modsecurity.conf"] [line "35"] [id "200001"].
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][5] Rule 362cf58: SecRule "REQUEST_HEADERS:Content-Type" "@rx application/json" "phase:1,auditlog,id:200001,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=JSON"
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Rule returned 0.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] No match, not chained -> mode NEXT_RULE.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Second phase starting (dcfg 340d1d8).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Input filter: Reading request body.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] Input filter: Bucket type EOS contains 0 bytes.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Request body no files length: 0
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Input filter: Completed receiving request body (length 0).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Starting phase REQUEST_BODY.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] This phase consists of 4 rule(s).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Recipe: Invoking rule 3638ce0; [file "/app/soft/nginx/conf/modsecurity.conf"] [line "65"] [id "200002"].
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][5] Rule 3638ce0: SecRule "REQBODY_ERROR" "!@eq 0" "phase:2,auditlog,id:200002,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:%{reqbody_error_msg},severity:2"
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Transformation completed in 2 usec.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Executing operator "!eq" with param "0" against REQBODY_ERROR.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] Target value: "0"
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Operator completed in 9 usec.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Rule returned 0.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] No match, not chained -> mode NEXT_RULE.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Recipe: Invoking rule 2fb8310; [file "/app/soft/nginx/conf/modsecurity.conf"] [line "86"] [id "200003"].
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][5] Rule 2fb8310: SecRule "MULTIPART_STRICT_ERROR" "!@eq 0" "phase:2,auditlog,id:200003,t:none,log,deny,status:400,msg:'Multipart request body failed strict validation: PE %{REQBODY_PROCESSOR_ERROR}, BQ %{MULTIPART_BOUNDARY_QUOTED}, BW %{MULTIPART_BOUNDARY_WHITESPACE}, DB %{MULTIPART_DATA_BEFORE}, DA %{MULTIPART_DATA_AFTER}, HF %{MULTIPART_HEADER_FOLDING}, LF %{MULTIPART_LF_LINE}, SM %{MULTIPART_MISSING_SEMICOLON}, IQ %{MULTIPART_INVALID_QUOTING}, IP %{MULTIPART_INVALID_PART}, IH %{MULTIPART_INVALID_HEADER_FOLDING}, FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Transformation completed in 1 usec.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Executing operator "!eq" with param "0" against MULTIPART_STRICT_ERROR.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] Target value: "0"
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Operator completed in 4 usec.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Rule returned 0.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] No match, not chained -> mode NEXT_RULE.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Recipe: Invoking rule 32bf6d8; [file "/app/soft/nginx/conf/modsecurity.conf"] [line "91"] [id "200004"].
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][5] Rule 32bf6d8: SecRule "MULTIPART_UNMATCHED_BOUNDARY" "!@eq 0" "phase:2,auditlog,id:200004,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Transformation completed in 1 usec.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Executing operator "!eq" with param "0" against MULTIPART_UNMATCHED_BOUNDARY.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] Target value: "0"
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Operator completed in 4 usec.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Rule returned 0.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] No match, not chained -> mode NEXT_RULE.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Recipe: Invoking rule 2d29fb8; [file "/app/soft/nginx/conf/modsecurity.conf"] [line "105"] [id "200005"].
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][5] Rule 2d29fb8: SecRule "TX:/^MSC_/" "!@Streq 0" "phase:2,log,auditlog,id:200005,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Rule returned 0.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] No match, not chained -> mode NEXT_RULE.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Hook insert_filter: Adding input forwarding filter (r 3246980).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Hook insert_filter: Adding output filter (r 3246980).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Input filter: Forwarding input: mode=0, block=0, nbytes=-1 (f 3247bb8, r 3246980).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Input filter: Sent EOS.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Input filter: Input forwarding complete.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] Output filter: Receiving output (f 3247be0, r 3246980).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Starting phase RESPONSE_HEADERS.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] This phase consists of 0 rule(s).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] Content Injection: Not enabled.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] Output filter: Bucket type POOL contains 140 bytes.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] Output filter: Bucket type POOL contains 46 bytes.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] Output filter: Bucket type EOS contains 0 bytes.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Output filter: Completed receiving response body (buffered full - 186 bytes).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Starting phase RESPONSE_BODY.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] This phase consists of 0 rule(s).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Output filter: Output forwarding complete.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Initialising logging.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Starting phase LOGGING.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][9] This phase consists of 0 rule(s).
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Recording persistent data took 0 microseconds.
[15/Dec/2014:11:20:58 +0800] [sz-test-rd01/sid#340cea0][rid#3246980][/common/memberLogin.jsp][4] Audit log: Logging this transaction.

[csanders-git]

Can you provide the version of nginx and modsecurity you are using. Additionally, is this causing any segfaults or indicating that blocking is taking place anywhere? Additionally, can this be replicated via a legitimate request or other tools. Finally, can you provide the raw request that is causing this behavior? Thanks.

[wangxianwei]

1、version :nginx 1.6.2, Modsecurity 1.8.0
2、I find that all the post request have been denied, but the modsecurity did not denied the get post when i acess the website via a abnormal way.
3、The audit error in the following

--9514bc64-A--
[15/Dec/2014:13:37:47 +0800] AcAcAcAcAcAcA0AdMcAcAcAc 192.168.1.250 57610 127.0.0.1 80
--9514bc64-B--
POST /common/memberLogin.jsp HTTP/1.1
User-Agent: Fiddler
Host: www.352.com
Content-Length: 0

--9514bc64-C--

--9514bc64-F--
HTTP/1.1
Content-Type: text/html
Content-Length: 186
Connection: close

--9514bc64-E--

<title>500 Internal Server Error</title>

500 Internal Server Error

---

nginx

--9514bc64-H--
Message: Audit log: Failed to lock global mutex: Permission denied
Apache-Handler: IIS
Stopwatch: 1418621867000496 499429 (- - -)
Stopwatch2: 1418621867000496 499429; combined=487, p1=85, p2=344, p3=8, p4=7, p5=43, sr=0, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for nginx (STABLE)/2.8.0 (http://www.modsecurity.org/).
Server: ModSecurity Standalone
Engine-Mode: "DETECTION_ONLY"

--9514bc64-K--

--9514bc64-Z--

[wangxianwei]

@csanders-git , In the modsecurity .conf document, when i set the SecRequestBodyAccess to Off . the modsecurity don't denied the post request.

[csanders-git]

@wangxianwei based on that last comment, might this be a duplicate of #664 or #630?

Other have had success by using the "nginx_refactoring" branch.(https://github.com/SpiderLabs/ModSecurity/tree/nginx_refactoring_rebase)

[zimmerle]

Hi @csanders-git, i think you are right. It seems to be a duplicate. Closing this issue.

[wangxianwei]

Hi @zimmerle @csanders-git, I have installed the modsecurity-2.9.0-RC1 in the Nginx server, but the issue is still appearing, after i set the SecRequestBodyAccess to Off, there is no problem.