False Positive which can't be skipped?

Question

Hello everyone I have deployed the Firewall for quite some time now. Recently I noticed problems whilst uploading Files to my Synology NAS which sits behind a WAF. 
 After some short research I found that everytime certain Files are tried to upload the Following Errror occurs in the WAF Log: "Multipart parser detected a possible unmatched boundary". 
 I was unable to resolve the Problem. 
 I tried skipping the Filter Rule " 960915" in the Common threat Filter without success. If I disable the common Threat filter I can Upload the concerning Files without a Problem therefore It seems to be located there. 
 If I follow this guide: https://support.sophos.com/support/s/article/KB-000035562?language=en_US I can't find any entry with multipart oder other words matching my Log entry. 
 I am not an expert so maybe I am doing something Wrong but I can't seem to find the Issue. 
 The system is fully updated. Let me know what further Informations may help you! Thank you so much beforehand Greetings from Switzerland.

Vishal_R · Answer

Hi Ale_V2 Thank you for connecting with the Sophos community team. It may have chances that some other mod security rule also have been triggered that has detected an anomaly with the reason "Multipart parser detected a possible unmatched boundary" which you may check and get from reverseproxy.log around an issue or error time. Once you may get those rules you may again try by adding them in Skip filter rules to validate the issue status.

Vishal_R · Answer

Hi, Ale_V2 Regarding both the ID (200004 and 942110 ) I found blogs that confirm that a particular OWASP ModSecurity Rule id is generating frequent false positives. https://www.netnea.com/cms/apache-tutorial-6_embedding-modsecurity/ https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/827 For ID 942110 github.com/.../1648 https://gitlab.com/swisspost-evoting/e-voting/e-voting-documentation/-/blob/master/Operations/ModSecurity-CRS-Tuning-Concept.md Also, the same logs lines when both the above ID has been triggered - you may also share those logs with your In house Web App Dev team who is maintaining the end server for which WAF hosting is done to have their opinion on this detection i.e. that detection is a kind of false positive or not and it is ok to add ID in the skip filter rule to avoid such false detection or not. Unless and Until it is a non-infrastructure rule and you are also sure that the end legitimate user's actual genuine activity has been blocked and dropped due to anomaly detection, it is ok to add them in the exception by consulting In house Web App Dev team.

False Positive which can't be skipped?

Top Replies