Unexpected OWASP Managed Challenge Mangling Multi-Part Form Submissions

[david251]

A combination of the issue described in the closed post here:

Mangled/Different POST data sent after Managed Challenge

Hello Cloudflare Community, I’m faced with a problem that, quite frankly, has me stumped. Recently, users of our site have started complaining that editing certain large posts (which involves submitting a HTML form) on our website leads to a challenge page, followed by our website rejecting the edit. Looking at Security Events, I figured out that the managed challenges are triggered by WAF Managed Rule (specifically “OWASP SQL Injection Attack”), though in this case they are false positives. So…

and the post/my comment here:

Multi-Part Form Post Managed Challenge

To expand: We were led down some false debug leads because our backend (Django) was complaining about missing CSRF tokens. After some tribulation, we discovered this (the Managed Challenge). But we also discovered that the data in the request, after passing the managed challenge, was mangled into unusable gunk/garbage. That is actually what triggered the CSRF error. Might be another issue, but I wanted to describe it here for posterity.

In summary: we just wrapped up a wild goose chase to address a bug with image uploads within a form. The symptom was a “missing CSRF token” error on form submission (a POST). Cloudflare triggered a Managed Challenge, and transformed/garbled/mangled the data before forwarding the request to our servers, hence the error.

Has anyone seen this before, or have any idea what might be happening? Or is it just a bug that needs addressing?

Thanks!

[mcorreia]

Hi there,

My advice if that you open a browser/tab in the security live events, by going to Security > Events and setting the time to Previous 30 minutes (Live updating).

Then try to perform the action you’re trying to perform and see if it triggers anything there.
(Depending on your traffic you might want to filter by client IP)

If you see any event being triggered there, then it’s only a matter of creating exceptions to allow it trough.
Exceptions to Managed Rules can be created under Security > WAF > Managed rules > Add exception.
If you do decide to create an exception, try to be as specific as possible. The broader the exception the weaker the managed rules get.

Take care.

[david251]

I have already added an exception as a workaround .

But the data mangling felt like a bug or misconfiguration. Is that expected behavior, then?