0

I'm configuring a httpd to perform as a reverse proxy which should allow file uploads as well. Average file size is around 20MB. With basic configurations I could only upload files of max size 128KB.

After referring some materials, I installed modsecurity plugin to enable uploading files with max allowance of 30 MB.

In the mod_security.conf file, I have:

SecRuleEngine On
SecRequestBodyAccess On
SecRequestBodyLimit 31457280
SecRequestBodyNoFilesLimit 131072
SecRequestBodyInMemoryLimit 1048576
SecRequestBodyLimitAction Reject
SecRule REQBODY_ERROR "!@eq 0" "id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"

But if I try to upload even 1MB file, I get the below error:

[:error] [pid 7877] [client 10.192.10.186:47406] [client 10.192.10.186] ModSecurity: Multipart parsing error (init): Multipart: Invalid boundary in C-T (malformed). [hostname "<host>"] [uri "<uri>"] [unique_id "YmE-3e7SizASbXjV8cTWfQAAAAQ"]
[proxy:error] [pid 7877] (32)Broken pipe: [client 10.192.10.186:47406] AH01084: pass request body failed to 10.192.21.143:443
[proxy_http:error] [pid 7877] [client 10.192.10.186:47406] AH01097: pass request body failed to 10.192.21.143:443 () from 10.192.10.186 () 

The questions I have are:

  1. Am I using the correct plugging?
  2. What is the error in the above configuration?
2
  • Since you are using Apache as a proxy, I believe this is your problem SecRequestBodyInMemoryLimit 1048576. Apr 22, 2022 at 1:50
  • @JohnHanley are you suggesting SecRequestBodyInMemoryLimit should be increased beyond 1048576?
    – KTB
    Apr 27, 2022 at 1:36

1 Answer 1

0

OWASP ModSecurity Core Rule Set dev-on-duty here. Your error is the first alert message: "Multipart parsing error (init): Multipart: Invalid boundary in C-T (malformed)." The rest is Apache reacting to the ModSecurity parsing abort.

Based on my experience with ModSecurity I am confident we're facing a malformed multipart request. Try to submit a multipart request with curl to see if it works out. If it does, as I suspect, you need to look at your client. Probably by taking a very close look at the request body and the Content-Type header.

4
  • I created a sample file of 2MB, and even if I randomly remove a text chunk to make the file size just below 1MB, file upload works fine. But if it's more than 1MB, then I'm getting the error. So I think it's not a malformed multipart request???
    – KTB
    Apr 21, 2022 at 18:13
  • Shot in the dark: You set a SecRequestBodyInMemoryLimit of around 1MB, maybe there is an issue with putting larger incoming requests to disk for inspection. Try to play around with this value and check your ModSec Temp folders. There are several ones. For a production server 1MB is already very high, so don't do a 10MB workaround, since that would be a major DoS weakness.
    – dune73
    Apr 22, 2022 at 9:19
  • I tried a few configurations but didn't work. In the modsec audit file it says: Message: Multipart parsing error (init): Multipart: Invalid boundary in C-T (malformed). Message: Input filter: Failed to create temporary file: /usr/local/modsecurity/var/tmp/20220427-025356-YmiwRP58JOmCbh5m9AyKCQAAAAQ-request_body-JEFfBX
    – KTB
    Apr 27, 2022 at 2:55
  • The "Failed to create temporary file" is new. This confirms my impression below. This could be a permission problem on the temp folder.
    – dune73
    Apr 28, 2022 at 5:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.