Atomicorp WAF Rule 330793

Rule Summary

• Rule ID: 330793
• Status: Active
• Alert message: Multipart request body failed strict validation: PE %{REQBODY_ERROR}, BQ %{MULTIPART_BOUNDARY_QUOTED}, BW %{MULTIPART_BOUNDARY_WHITESPACE}, DB %{MULTIPART_DATA_BEFORE}, DA %{MULTIPART_DATA_AFTER}, HF %{MULTIPART_HEADER_FOLDING}, LF %{MULTIPART_LF_LINE}, SM %{MULTIPART_SEMICOLON_MISSING}, IQ %{MULTIPART_INVALID_QUOTING}, IH %{MULTIPART_INVALID_HEADER_FOLDING}, IP %{MULTIPART_INVALID_PART}, FL %{MULTIPART_FILE_LIMIT_EXCEEDED}
• Observed CWEs: CWE-416 (2), CWE-755 (2), CWE-824 (2), CWE-1325 (2)
• Revision: 3
• Rule severity: Critical (2)
• Phase: 2 (request body)
• Rule action: deny
• HTTP status: 403
• Logging: log, auditlog

Description

Rule 330793 enforces strict validation of multipart request bodies, commonly used by upload forms. ModSecurity’s multipart parser produces the diagnostic flags; this rule applies the configured enforcement action when strict validation fails. The parser and the rule have different roles: the parser describes the request structure, while the rule controls whether processing may continue.

This protects request-body inspection from ambiguous or unsupported multipart formatting. It is a general request-validation control and does not require a matching CVE.

Behavior

The current rule runs in phase 2, after request-body parsing, and logs and audit-logs its alert. With blocking enabled it denies a matching request with HTTP 403. In DetectionOnly mode it records the event without enforcing the denial. Local exclusions and the active ruleset determine whether it is evaluated for a particular application.

Reading the Alert

The message begins Multipart request body failed strict validation and includes abbreviated parser indicators. Use the complete transaction and engine version when interpreting them.

A populated flag value of 1 identifies a reported condition; 0 means that flag was not set. An empty or unavailable field is not a verified zero. Available variables and details differ across ModSecurity versions. The current primary rule uses REQBODY_ERROR for PE; older alert formats may reference REQBODY_PROCESSOR_ERROR.

For example, a sanitized alert showing IQ 1 directs investigation to quoting in the multipart structure. It does not identify which uploaded file is malicious or prove that exploitation occurred.

Troubleshooting

Compatibility and False Positives

Strict multipart validation can reject unusual formatting from a legitimate client. Some formatting accepted by the multipart standard can also be flagged by a strict parser policy; for example, RFC 7578 permits a quoted boundary parameter. Treat the specific diagnostic as evidence to investigate, rather than proof that every request triggering this rule is an attack.

Check the client or upload library, intervening proxy, Content-Type boundary parameter, multipart part headers, line endings and configured upload limits. Compare the failing transaction with a successful request from the same application. A truncated upload or differing interpretation between the frontend and application also warrants investigation.

Recommended Response

Correct malformed requests at their source and keep the web server, ModSecurity engine and client libraries current. For a legitimate request that still triggers strict validation, send a sanitized reproducer and the diagnostic flags to Atomicorp Support. Include the application, connector and engine versions, relevant upload limits, rule revision and whether the request was actually denied.

Remove credentials, session cookies, personal data and uploaded contents from shared examples. Preserve the multipart formatting needed to explain the problem without including private data.

Tuning Guidance

Do not edit Atomicorp-managed files or globally disable multipart inspection to accommodate one application. Use the supported local tuning process for a reviewed, narrowly scoped exception, while retaining appropriate request-body validation. Changing a limit should follow the application’s requirements and the reported diagnostic, rather than treating every multipart alert as a size-limit issue.

See Atomicorp rule tuning guidance and reporting false positives .

References

• ModSecurity reference: multipart strict validation (opens in a new tab)
• RFC 7578: multipart/form-data and boundary parameters (opens in a new tab)

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

Documentation Source

• Original wiki page: WAF 330793
• Source revision: 5014
• Source revision date: 2014-08-12