0

I have problem when implementing modsecurity and crs. Here is the issue, I hope anyone can give us some guide for resolving this issue.

Apache version :

Server version: Apache/2.4.29 (Ubuntu) Server built:
2022-06-23T12:51:37

ModSecurity version :

modsecurity-2.9.6 (compiled from source)

Error :

[id "-"][file "/etc/apache2/modsecurity.d/owasp-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "92"] - Execution error - PCRE limits exceeded (-8): (null).
[id "-"][file "/etc/apache2/modsecurity.d/owasp-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "249"] - Execution error - PCRE limits exceeded (-8): (null).
[id "-"][file "/etc/apache2/modsecurity.d/owasp-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "276"] - Execution error - PCRE limits exceeded (-8): (null).
[id "-"][file "/etc/apache2/modsecurity.d/owasp-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "329"] - Execution error - PCRE limits exceeded (-8): (null).
[id "-"][file "/etc/apache2/modsecurity.d/owasp-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "355"] - Execution error - PCRE limits exceeded (-8): (null).
[id "-"][file "/etc/apache2/modsecurity.d/owasp-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "381"] - Execution error - PCRE limits exceeded (-8): (null).
[id "-"][file "/etc/apache2/modsecurity.d/owasp-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "407"] - Execution error - PCRE limits exceeded (-8): (null).
[id "-"][file "/etc/apache2/modsecurity.d/owasp-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "433"] - Execution error - PCRE limits exceeded (-8): (null).
[id "-"][file "/etc/apache2/modsecurity.d/owasp-crs/rules/RESPONSE-951-DATA-LEAKAGES-SQL.conf"][line "459"]

Thing What I have done :

Set this value (tested before or after load crs.conf):

 SecPcreMatchLimit 5000000 
 SecPcreMatchLimitRecursion 5000000

Add in php.ini

pcre.backtrack_limit=1000000
pcre.recursion_limit=1000000

restart php-fpm and apache2

And no luck!, the issue still persist.

Any ideas how to fix this.

Thank you.

2 Answers 2

2

Unfortunately the PCRE limits exceeded error is "unsolvable" (which is - of course - not true; you can review the arguments of @rx operators). You can read about this here.

Don't increase SecPcreMatchLimit and SecPcreMatchLimitRecursion values, that won't solve this.

Increasing value of mentioned PHP variables makes your application vulnerable - keep it as low.

Both of them (ModSecurity and PHP) variables control the PCRE engine, how many times it can repeat match the pattern. If you increase any of them, you just allow the engine to work with regex again and again... It's easy way to execute a DoS.

1
  • Thank you for your comment and the suggestion for it. However after click the link, it also does not fix the issue.
    – navotera
    Oct 20, 2022 at 8:38
0

ModSecurity's default configuration purposely sets very low initial SecPcreMatchLimit values.

apache24-2.4.58
modsecurity-2.9.7

Edit etc/apache24/modsecurity.d/modsecurity.conf

Locate the following section:

# PCRE Tuning
# We want to avoid a potential RegEx DoS condition
#
SecPcreMatchLimit 1000
SecPcreMatchLimitRecursion 1000

Adjust SecPcreMatchLimit up in steps of one or two thousand until the the errors are eventually suppressed. Apache will need to be restarted with each adjustment.

In my case, I have a Joomla CMS that would routinely throw these pcre limit errors simply browsing the web site or accessing the administration area. Adjusting SecPcreMatchLimit up to a value of 50000 was sufficient to resolve the issue for my environment.

I suggest leaving SecPcreMatchLimitRecursion unmodified at the default 1000. I also recommend that if these/similar directives have been modified in either php.ini or httpd.conf in an attempt to resolve this issue, that they be restored to their default/original values.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .