False positive response when using Drupal

[Munrok]

I have a website built on Drupal. In the backend, an AJAX request is made to display the content of the media section, but it is being blocked.

ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\x0b#]*)?(?:#[^\s\x0b]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\x0b]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z (88 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /views/ajax?destination=/admin/content&ajax_form=1&_wrapper_format=drupal_ajax&media_library_ope (1678 characters omitted)' ) [file "/usr/local/etc/nginx/modsecurity/coreruleset/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /views/ajax?destination=/admin/content&ajax_form=1&_wrapper_format=drupal_ajax&media_library_opener_id=media_library.opener.field_widget&media_library_allowed_types%5Bimage%5D=image&media_library_ (1578 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.3.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "server_ip"] [uri "/views/ajax"] [unique_id "172858601680.784554"] [ref "v0,1778"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/usr/local/etc/nginx/modsecurity/modsecurity.conf"] [line "136"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "server_ip"] [uri "/views/ajax"] [unique_id "172858601680.784554"] [ref ""]

[azurit]

Hi @Munrok, what version of CRS are you running?

[Munrok]

Hi @Munrok, what version of CRS are you running?

4.3.0

[azurit]

@Munrok Have you enabled Drupal rule exclusions plugin?

[dankegel]

Looks like OWASP_CRS/4.3.0

I am not an expert, but: can you paste in the full line from the web server log? The waf log you pasted doesn't show the full request (and wasn't blocked when I tried it with the card sandbox, so the missing bits might be useful)

[Munrok]

@Munrok Have you enabled Drupal rule exclusions plugin?

Yes, I am using the specified plugin all the time.

Looks like OWASP_CRS/4.3.0

I am not an expert, but: can you paste in the full line from the web server log? The waf log you pasted doesn't show the full request (and wasn't blocked when I tried it with the card sandbox, so the missing bits might be useful)

Is what I showed not enough?

[azurit]

@Munrok Can you show the full URL you are trying to access? You can censor the domain name.

You are hitting rule 920100 which means your HTTP request line is invalid. This is probably NOT a false positive.

[Munrok]

GET /views/ajax?destination=/admin/content&ajax_form=1&_wrapper_format=drupal_ajax&media_library_opener_id=media_library.opener.field_widget&media_library_allowed_types%5Bimage%5D=image&media_library_selected_type=image&media_library_remaining=1&media_library_opener_parameters%5Bfield_widget_id%5D=field_miniaturka_media&media_library_opener_parameters%5Bentity_type_id%5D=node&media_library_opener_parameters%5Bbundle%5D=galeria&media_library_opener_parameters%5Bfield_name%5D=field_miniaturka_media&media_library_opener_parameters%5Bentity_id%5D=244&media_library_opener_parameters%5Brevision_id%5D=244&hash=aWnCmOAzWNJjN9G6fDA4zeXseCaHn-FyNYfuza5UzD8&destination=/admin/content&_wrapper_format=drupal_ajax&directory=409&name=&sort_by=created&view_name=media_library&view_display_id=widget&view_args=image&view_path=%2Fnode%2F244%2Fedit&view_base_path=admin%2Fcontent%2Fmedia-widget&view_dom_id=cf49c76053ea0f244d4ac2ba94851381ebbb52fab5040f7332e841ace77e1673&pager_element=0&_drupal_ajax=1&ajax_page_state%5Btheme%5D=claro&ajax_page_state%5Btheme_token%5D=MEYMm13hTQT9wo059uqfg670wVT_7_xZ2Dl6bQBxsyA&ajax_page_state%5Blibraries%5D=eJyNVNuSmzAM_SEDT_2AtrP71Jl-AiOMAmrkS21BdvfrKxNINtB28mJL58jHsiwbeke-lRC4g9Sscy0J0cA_qXoMMybT0dBGithshrFn7ElC-tKQF0weuO7TFHW6Mc_E1Db0-I2DPT8VjS6OkCk_FTyK4xc_kH8q25ocDM9FCnSskQwpNCvpYa4Uzit6CslVcgmVDTw5v8EDhw64yvLO5IcVdCoLLVOXIL3XMqJT7aCbv8kEvG1wRypde87_D1mvUIMSNvfEgWnwDr0ciElCyRkOTFfu5vcUBPfMGBJ96JbAP5YSP7IlySOWD_oRsuBrCu7n6UT2IJPQaQO-_jW1HKZk8UW9pZg7MqIl4O8jJLB6kXkfIAl8ZhAKPteRr_RaSV1BM1b3M2y4lskGFxm3ctxKzwwxP4JZQDA_QEvn9AmGI5owR01F971yvpyZ6QPNNeMW-hm8xb4tad0PYk7EN6ViF0AP_AlSzzx0WTPRDrhQP6AY3-XYlOHTK_b6Qm9trvYVKN1iIsi4UcVegFKkTS-pSEIrW9Dm18uPY9LYLmJlqBbFrF0ldrot2Hyz-5z2fo3ZQsSvi6xoYzRlMFO-F6LYNekjyWYmvORmGWv4BW8PgAv9xPgH68L9PQ HTTP/2.0
sec-fetch-mode: cors
sec-fetch-dest: empty
host: domian.com
priority: u=0
accept: application/json, text/javascript, */*; q=0.01
te: trailers
accept-language: pl,en-US;q=0.7,en;q=0.3
cookie: _ga_FHNXZCVD0Y=GS1.1.1728585997.3.0.1728586000.0.0.0; _ga=GA1.2.485778954.1728317770; SSESScfb6b20ef603c483e2cd2b6bbd5536e1=wUma7BQQCQcgdSRxuJWOQorOeOmxdIOgwQKPW8YXv0dFY2a%2C; has_js=1; _gid=GA1.2.1201877706.1728585997; _gat_gtag_UA_160011213_1=1
accept-encoding: gzip, deflate, br, zstd
x-requested-with: XMLHttpRequest
referer: https://domain.com/node/244/edit?destination=/admin/content
sec-fetch-site: same-origin
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0

[fzipi]

I figured that this one belongs here probably.

[EsadCetiner]

@Munrok What value do you have SecPcreMatchLimit and SecPcreMatchLimitRecursion set to? It's known that if you set that value too low, then 920100 will incorrectly trigger. Can you try increasing both values to 100000 or higher (The default values are known to be very strict) and seeing if it fixes your issue?

Please See: coreruleset/coreruleset#3640 (comment)

[azurit]

@Munrok Ping.