owasp-modsecurity / owasp-modsecurity/ModSecurity

Bug: Premature EOF in JSON leads to status 500 instead of REQBODY_ERROR

Open
#2,807 10 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

2.x
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

Describe the bug

Instead of failing safely, ModSec triggers a status 500.

$ cat example.json
{ "id" : "123"
$ curl -v http://localhost -H "Content-Type: application/json" -d @example.json
...
< HTTP/1.1 500 Internal Server Error
...

Logs and dumps

[2022-10-05 11:17:58.926606] [-:error] 127.0.0.1:39976 Yz1Lxuf_TBfAeTSTcu5oFwAAAAk [client 127.0.0.1] ModSecurity: JSON parser error: parse error: premature EOF\n [hostname "localhost"] [uri "/"] [unique_id "Yz1Lxuf_TBfAeTSTcu5oFwAAAAk"]
[2022-10-05 11:17:58.926624] [-:error] 127.0.0.1:39976 Yz1Lxuf_TBfAeTSTcu5oFwAAAAk [client 127.0.0.1] ModSecurity: JSON parser error: parse error: premature EOF\n [hostname "localhost"] [uri "/"] [unique_id "Yz1Lxuf_TBfAeTSTcu5oFwAAAAk"]
[2022-10-05 11:17:58.926629] [core:trace3] 127.0.0.1:39976 Yz1Lxuf_TBfAeTSTcu5oFwAAAAk fixups hook gave 500: /

Server (please complete the following information):

  • ModSecurity version (and connector): ModSec 2.9.6
  • WebServer: Apache 2.5.54

Additional information:

I played around with broken JSON payloads following a customer request. This was the only case where I could make ModSecurity stumble.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file, test, or entry point is named. First reproduce the malformed JSON request against ModSecurity 2.9.6 with Apache, then trace handling of the reported JSON parser error; done means the premature EOF fails safely with REQBODY_ERROR instead of HTTP 500.

Written by the indexing model from the issue text.

Assessment

Tech stack
apache, cpp
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.