Skip to content

False positive response when using Drupal #8

Closed
Closed
False positive response when using Drupal#8

Description

@Munrok
Munrok
opened on Oct 13, 2024

I have a website built on Drupal. In the backend, an AJAX request is made to display the content of the media section, but it is being blocked.

ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\x0b#]*)?(?:#[^\s\x0b]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\x0b]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z (88 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /views/ajax?destination=/admin/content&ajax_form=1&_wrapper_format=drupal_ajax&media_library_ope (1678 characters omitted)' ) [file "/usr/local/etc/nginx/modsecurity/coreruleset/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /views/ajax?destination=/admin/content&ajax_form=1&_wrapper_format=drupal_ajax&media_library_opener_id=media_library.opener.field_widget&media_library_allowed_types%5Bimage%5D=image&media_library_ (1578 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "server_ip"] [uri "/views/ajax"] [unique_id "172858601680.784554"] [ref "v0,1778"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/usr/local/etc/nginx/modsecurity/modsecurity.conf"] [line "136"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "server_ip"] [uri "/views/ajax"] [unique_id "172858601680.784554"] [ref ""]

Activity

  1. azurit commented on Oct 14, 2024

    @azurit
    azurit
    on Oct 14, 2024
    Member

    Hi @Munrok, what version of CRS are you running?

  2. Munrok commented on Oct 14, 2024

    @Munrok
    Munrok
    on Oct 14, 2024
    Author

    Hi @Munrok, what version of CRS are you running?

    4.3.0

  3. azurit commented on Oct 14, 2024

    @azurit
    azurit
    on Oct 14, 2024
    Member

    @Munrok Have you enabled Drupal rule exclusions plugin?

  4. dankegel commented on Oct 14, 2024

    @dankegel
    dankegel
    on Oct 14, 2024

    Looks like OWASP_CRS/4.3.0

    I am not an expert, but: can you paste in the full line from the web server log? The waf log you pasted doesn't show the full request (and wasn't blocked when I tried it with the card sandbox, so the missing bits might be useful)

  5. Munrok commented on Oct 16, 2024

    @Munrok
    Munrok
    on Oct 16, 2024
    Author

    @Munrok Have you enabled Drupal rule exclusions plugin?

    Yes, I am using the specified plugin all the time.

    Looks like OWASP_CRS/4.3.0

    I am not an expert, but: can you paste in the full line from the web server log? The waf log you pasted doesn't show the full request (and wasn't blocked when I tried it with the card sandbox, so the missing bits might be useful)

    Is what I showed not enough?

  6. azurit commented on Oct 17, 2024

    @azurit
    azurit
    on Oct 17, 2024
    Member

    @Munrok Can you show the full URL you are trying to access? You can censor the domain name.

    You are hitting rule 920100 which means your HTTP request line is invalid. This is probably NOT a false positive.

  7. Munrok commented on Oct 21, 2024

    @Munrok
    Munrok
    on Oct 21, 2024
    Author
    GET /views/ajax?destination=/admin/content&ajax_form=1&_wrapper_format=drupal_ajax&media_library_opener_id=media_library.opener.field_widget&media_library_allowed_types%5Bimage%5D=image&media_library_selected_type=image&media_library_remaining=1&media_library_opener_parameters%5Bfield_widget_id%5D=field_miniaturka_media&media_library_opener_parameters%5Bentity_type_id%5D=node&media_library_opener_parameters%5Bbundle%5D=galeria&media_library_opener_parameters%5Bfield_name%5D=field_miniaturka_media&media_library_opener_parameters%5Bentity_id%5D=244&media_library_opener_parameters%5Brevision_id%5D=244&hash=aWnCmOAzWNJjN9G6fDA4zeXseCaHn-FyNYfuza5UzD8&destination=/admin/content&_wrapper_format=drupal_ajax&directory=409&name=&sort_by=created&view_name=media_library&view_display_id=widget&view_args=image&view_path=%2Fnode%2F244%2Fedit&view_base_path=admin%2Fcontent%2Fmedia-widget&view_dom_id=cf49c76053ea0f244d4ac2ba94851381ebbb52fab5040f7332e841ace77e1673&pager_element=0&_drupal_ajax=1&ajax_page_state%5Btheme%5D=claro&ajax_page_state%5Btheme_token%5D=MEYMm13hTQT9wo059uqfg670wVT_7_xZ2Dl6bQBxsyA&ajax_page_state%5Blibraries%5D=eJyNVNuSmzAM_SEDT_2AtrP71Jl-AiOMAmrkS21BdvfrKxNINtB28mJL58jHsiwbeke-lRC4g9Sscy0J0cA_qXoMMybT0dBGithshrFn7ElC-tKQF0weuO7TFHW6Mc_E1Db0-I2DPT8VjS6OkCk_FTyK4xc_kH8q25ocDM9FCnSskQwpNCvpYa4Uzit6CslVcgmVDTw5v8EDhw64yvLO5IcVdCoLLVOXIL3XMqJT7aCbv8kEvG1wRypde87_D1mvUIMSNvfEgWnwDr0ciElCyRkOTFfu5vcUBPfMGBJ96JbAP5YSP7IlySOWD_oRsuBrCu7n6UT2IJPQaQO-_jW1HKZk8UW9pZg7MqIl4O8jJLB6kXkfIAl8ZhAKPteRr_RaSV1BM1b3M2y4lskGFxm3ctxKzwwxP4JZQDA_QEvn9AmGI5owR01F971yvpyZ6QPNNeMW-hm8xb4tad0PYk7EN6ViF0AP_AlSzzx0WTPRDrhQP6AY3-XYlOHTK_b6Qm9trvYVKN1iIsi4UcVegFKkTS-pSEIrW9Dm18uPY9LYLmJlqBbFrF0ldrot2Hyz-5z2fo3ZQsSvi6xoYzRlMFO-F6LYNekjyWYmvORmGWv4BW8PgAv9xPgH68L9PQ HTTP/2.0
sec-fetch-mode: cors
sec-fetch-dest: empty
host: domian.com
priority: u=0
accept: application/json, text/javascript, */*; q=0.01
te: trailers
accept-language: pl,en-US;q=0.7,en;q=0.3
cookie: _ga_FHNXZCVD0Y=GS1.1.1728585997.3.0.1728586000.0.0.0; _ga=GA1.2.485778954.1728317770; SSESScfb6b20ef603c483e2cd2b6bbd5536e1=wUma7BQQCQcgdSRxuJWOQorOeOmxdIOgwQKPW8YXv0dFY2a%2C; has_js=1; _gid=GA1.2.1201877706.1728585997; _gat_gtag_UA_160011213_1=1
accept-encoding: gzip, deflate, br, zstd
x-requested-with: XMLHttpRequest
referer: https://domain.com/node/244/edit?destination=/admin/content
sec-fetch-site: same-origin
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0
  8. fzipi
    transferred this issue fromcoreruleset/coreruleseton Jan 12, 2025
  9. fzipi
    changed the title [-] False positive response when usting Drupal[/-] [+] False positive response when using Drupal[/+] on Jan 12, 2025

  10. fzipi commented on Jan 12, 2025

    @fzipi
    fzipi
    on Jan 12, 2025
    Member

    I figured that this one belongs here probably.

  11. EsadCetiner commented on Mar 28, 2025

    @EsadCetiner
    EsadCetiner
    on Mar 28, 2025
    Member

    @Munrok What value do you have SecPcreMatchLimit and SecPcreMatchLimitRecursion set to? It's known that if you set that value too low, then 920100 will incorrectly trigger. Can you try increasing both values to 100000 or higher (The default values are known to be very strict) and seeing if it fixes your issue?

    Please See: coreruleset/coreruleset#3640 (comment)

  12. azurit commented on Nov 1, 2025

    @azurit
    azurit
    on Nov 1, 2025
    Member

    @Munrok Ping.

  13. azurit
    closed this as completedon Oct 3, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions