Atomicorp WAF Rule 340152

Rule Summary

• Rule ID: 340152
• Status: Active
• Alert message: Request Body Parsing Failed. %{REQBODY_ERROR_MSG}: check your application or client for errors, this is not a false positive.
• Observed CWEs: CWE-20 (2), CWE-22 (6), CWE-27 (1), CWE-74 (1), CWE-77 (1), CWE-78 (9), CWE-79 (13), CWE-89 (6), CWE-94 (3), CWE-98 (1), CWE-200 (6), CWE-209 (1), CWE-255 (2), CWE-264 (4), CWE-285 (1), CWE-287 (2), CWE-288 (1), CWE-306 (3), CWE-352 (2), CWE-362 (1), CWE-416 (1), CWE-434 (8), CWE-502 (1), CWE-534 (1), CWE-611 (10), CWE-732 (1), CWE-829 (1), CWE-862 (2), CWE-863 (2), CWE-917 (1), CWE-918 (1), CWE-1336 (1)
• Revision: 1
• Rule severity: Notice (5)
• Phase: 2 (request body)
• Rule action: deny
• HTTP status: 400
• Logging: log, auditlog

Description

This is not a triggered rule, but a rule that is triggered when a multi-part message can not be assembled correctly. Typically this is caused when a multipart/request-data parser or XML parser fails to properly parse a request payload, generally because of either a broken client or client library, or a broken or corrupt request.

This is not a false positive, it seemly means that your application or client is creating multi-part messages that can not be assembled, either by ModSecurity or by the application. Check your applicant or client for the cause of this error and ensure that multipart messages are being sent and generated correctly.

It is not recommended you disable this rule. Doing so will leave your system open to impedance mismatch attacks . It is possible, for example, that a payload that cannot be parsed by ModSecurity can be successfully parsed by a more tolerant parser operating in the application. Therefore an attack could be passed through without detection.

False Positives

There are no known False Positives for this rule.

Selected Related CVEs

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

Observed CWEs

These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.

Documentation Source

• Original wiki page: WAF 340152
• Source revision: 2310
• Source revision date: 2012-05-07