CODEWITHSUNDEEP
magentomod-securitymultipartform-data
user1064386
user1064386

Reputation: 139

MULTIPART_STRICT_ERROR marking product upload in magento as malicous

I am running a magento installation for one of my client and the server there has modSecurity installed.

While I was trying to upload the products, I have been getting the following error.

Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/conf/modsec2.conf"] [line "15"] [id "1500860"] [msg "Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 0, DA 0, HF 0, LF 0, SM 0, IQ 1, IP , IH 0, FL 0"] [hostname "newsite.gogifts.in"] [uri "/index.php/admin/catalog_product_gallery/upload/key/8a40202b18c590f502a1ea9553813319/"]

It is a shared hosting server and hence I am unable to change any settings at the apache level.

Can someone help me with this? Help would be greatly appreciated

Upvotes: 2

Views: 9385

Answers (2)

Kent
Kent

Reputation: 423

The list in the error shows what it have reacted to, in this case IQ (MULTIPART_INVALID_QUOTING).

PE 0, BQ 0, BW 0, DB 0, DA 0, HF 0, LF 0, SM 0, IQ 1, IP , IH 0, FL 0

Did you have a quote character in your filename? e.g. some'file.txt. You can ask the shared hosting provider if they can loosen their policy.

Here is the list of what the abbreviations mean: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual-(v2.x)#MULTIPART_STRICT_ERROR

Upvotes: 4

Jason
Jason

Reputation: 721

I just encountered this Match of 'eq 0' against 'MULTIPART_STRICT_ERROR required in my project.

How is this error caused?
This error is caused by mod_security blocking a potentially malicious upload. While it may be completely harmless, mod_security has no way of knowing if it is harmless or not. Typically, the content in question is a file being uploaded which contains a special character such as a single or double quote within the file name which is often used by attackers to inject malicious scripts into websites.

How do I resolve the issue?
Simply put, rename the file to remove the offending special character from the file name or (disable this security rule in /etc/{path}/mod_security.conf by commenting the line " SecRule MULTIPART_STRICT_ERROR "!@eq 0" \" or by .htaccess file - NOT RECOMMENDED AT ALL)

Upvotes: 3

Related Questions