upload file failed.

[877509395]

Describe the bug

curl -F "filename=@file_name_to_be_upload" www.test00003.com

but "403 Forbidden" received.

the key info:
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator Eq' with parameter 0' against variable MULTIPART_UNMATCHED_BOUNDARY' **(Value: 2'** ) [file "/usr/local/nginx/conf/rules/modsecurity.conf"] [line "74"] [id "200004"] [rev ""] [msg "Multipart parser detected a possible unmatched boundary."] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "172.18.0.3"] [uri "/"] [unique_id "1640166975"] [ref "v181,1"]

[root@localhost work]# curl --version
curl 7.80.0 (x86_64-pc-linux-gnu) libcurl/7.80.0 zlib/1.2.7 OpenLDAP/2.4.44
Release-Date: 2021-11-10
Protocols: dict file ftp gopher http imap ldap mqtt pop3 rtsp smtp telnet tftp
Features: alt-svc AsynchDNS IPv6 Largefile libz UnixSockets

Logs and dumps

attached.

Notice: Be carefully to not leak any confidential information.

Server (please complete the following information):

• ModSecurity version (and connector): [e.g. ModSecurity v3.0.6 with nginx-connector v1.0.2]
• WebServer: [e.g. nginx-1.20.1]
• OS (and distro): [centos7.6]

Rule Set (please complete the following information):
core rule
debug.log
audit.log
3.4

[877509395]

maybe bug in multipart.cc

[877509395]

should same as 1900

[martinhsv]

Hello @877509395 ,

Did you change rule 200004, from the default?

@eq 1

to instead be:

@eq 2

If so, in future please include such important details (especially non-default settings) in your reports.

I do not recommend changing 200004 from the default content in modsecurity.conf-recommended.

There are known issues related to the setting of '2'. If a multipart request body contains only one part that is one problem situation for the '2' setting.

If you want to know more about this you can have a look at:
owasp-modsecurity/ModSecurity-nginx#244
#2417

[877509395]

Yes, Martin, After recover to "@eq 1" , it is OK. SecRule MULTIPART_UNMATCHED_BOUNDARY "@eq 1" \ "id:'200004',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'" thanks huiming