I'm getting the following ModSecurity error when posting form data to a LiquidWeb server:

Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 1, HF 0, LF 0, SM 0, IQ 0, IP 0, IH 0, FL 0

As you can see DB and DA have been set to 1. And looking at the ModSecurity docs on this, DB means MULTIPART_DATA_BEFORE and DA means MULTIPART_DATA_AFTER, which isn't very helpful.

Can anyone explain what these mean?


Although I'm not cent percent sure about their actual definitions. DB and DA should correspond to preamble and epilogue around multi-part boundaries . Which may sound platonic at first, until you read about the recent BadEpilogue Malware evasion.

After-all, organizations which has this detection turned-on are not completely paranoiac.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.