2

I have Apache 2.4 and mod_security 2.9.1 installed, and it is working, with some very basic rules.

I am trying to make a POST request that includes some header information, but doesn't have anything in the request body (the request is to an API endpoint which is being protected by mod_security, and that endpoint requires a POST without the request body). A POST that doesn't require a body is valid, per the following: Are PUT and POST requests required/expected to have a request body?

mod_security is blocking the request because it seems that it can't parse/format the body (likely because it doesn't exist).

How can I amend the rules to permit a POST without a body, but otherwise act as normal if the body does exist.

The specific rule that is being triggered is:

SecRule REQBODY_ERROR "!@eq 0" \
"id:'200002', phase:2,t:none,log,deny,status:415,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"

The error is:

[Fri Jul 08 10:32:32.901230 2016] [:error] [pid 7697] [client 10.0.2.2:57442] [client 10.0.2.2] ModSecurity: JSON parser error: parse error: premature EOF\n [hostname "example.com"] [uri "/api/v1/logout"] [unique_id "V377qH8AAQEAAB4RU6cAAAAD"]

[Fri Jul 08 10:32:32.901555 2016] [:error] [pid 7697] [client 10.0.2.2:57442] [client 10.0.2.2] ModSecurity: Access denied with code 415 (phase 2). Match of "eq 0" against "REQBODY_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "61"] [id "200002"] [msg "Failed to parse request body."] [data "JSON parser error: parse error: premature EOF\\x0a"] [severity "CRITICAL"] [hostname "example.com"] [uri "/api/v1/logout"] [unique_id "V377qH8AAQEAAB4RU6cAAAAD"]

Or, should I simply not send a Content-Type HTTP header in order to get mod_security to parse the body (although I'd prefer to enforce that all POST requests always have a defined Content-Type)?

I've made a gist of the full modsecurity.conf that is being used (which is a basic example with two extra rules for filtering Content-Types).

Community
  • 1
  • 1
pnairn
  • 1,737
  • 3
  • 17
  • 24
  • If you don't have content, you don't have a content-type. – Tony Chiboucas Jul 08 '16 at 02:22
  • Hi, but for security is it not best practice to ensure that POST requests always have the Content-Type? Or is it a "only have the content-type if you have a body" scenario? – pnairn Jul 08 '16 at 05:54
  • mod_security does content validation. Valid HTTP requires a message-body, unless it is a 100, 204, or 304 HT Response. https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html – Tony Chiboucas Jul 08 '16 at 17:49
  • when you set a content-type, of "text/html" for instance, mod_security will make sure the content is valid, which for html, the shortest valid content is ` ` though techincally, it won't pass most validators, while this will ` shortest html5` – Tony Chiboucas Jul 08 '16 at 17:57

1 Answers1

3

You can disable body access for a request with zero body length:

SecRule REQUEST_BODY_LENGTH "@eq 0" "id:12345,phase:1,nolog,ctl:requestBodyAccess=off"

Or if you only want to do this on a certain URL then use a chained rule like this:

SecRule REQUEST_URI /my/weird/api "phase:1,id:12346,nolog,chain"
   SecRule REQUEST_BODY_LENGTH "@eq 0" "ctl:requestBodyAccess=off"
Barry Pollard
  • 40,655
  • 7
  • 76
  • 92
  • That is a very hacky solution that does not actually address the problem. – Tony Chiboucas Jul 20 '16 at 17:53
  • Sending POST requests without a body is a very jacket thing to do! – Barry Pollard Jul 20 '16 at 18:02
  • 1
    Updated answer to have better solutions. Happier with that? – Barry Pollard Jul 21 '16 at 18:17
  • That's not entirely correct. Especially with respect to APIs. Rather than turning off content detection, the request should not specify a content-type. Better would be to sent a text content-type, and have the content contain only an encoded checksum. – Tony Chiboucas Jul 21 '16 at 19:01
  • However, given that you've amended your solution to be url-specific, it would be sufficient. – Tony Chiboucas Jul 21 '16 at 19:03
  • 1
    New [syntax](https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#secrequestbodyaccess) is `SecRule REQUEST_BODY_LENGTH "@eq 0" "id:12345,phase:1,nolog,ctl:requestBodyAccess=Off"` – vikas027 Jun 22 '17 at 11:25