Forms and uploads returning 403 after PHP2Shell? Your WAF rule is too broad

# Blanket rule (what a host often deploys): blocks EVERY multipart POST,
# so file uploads and some forms start returning 403.
SecRule REQUEST_HEADERS:Content-Type "@contains multipart/form-data" \
  "id:1002600,phase:1,deny,status:403,log,msg:'block all multipart'"

# Scoped rule: block only the PHP2Shell probe, which carries the
# upload-progress field. Normal uploads do not, so they get through.
SecRule REQUEST_HEADERS:Content-Type "@contains multipart/form-data" \
  "id:1002601,phase:2,chain,deny,status:403,log,msg:'PHP2Shell upload_progress probe'"
  SecRule REQUEST_BODY|MULTIPART_PART_HEADERS "@rx PHP_SESSION_UPLOAD_PROGRESS" "t:none"

#!/usr/bin/env node
// triage-403.mjs: after a blanket "block all multipart" rule starts returning
// 403s, work out which blocked requests were actually the PHP2Shell probe and
// which were ordinary forms and uploads. Point it at an access log (combined
// format) or pipe raw requests in; it reports the POSTs a *scoped* rule would
// still have caught vs the legitimate traffic a blanket rule broke.
//
//   node triage-403.mjs /var/log/nginx/access.log       # summarise 403s on POST
//   node triage-403.mjs --body request.txt              # classify one raw request
//
// The PHP2Shell signature is the session.upload_progress field in a multipart
// body (PHP_SESSION_UPLOAD_PROGRESS). Normal forms and uploads never carry it,
// so a rule keyed on it blocks the attack without breaking your site.
import fs from "node:fs";
import { pathToFileURL } from "node:url";

const SIGNATURE = /name="PHP_SESSION_UPLOAD_PROGRESS|\bPHP_SESSION_UPLOAD_PROGRESS\b/i;

/** Classifies a raw HTTP request (headers + body) as attack-shaped or ordinary. */
export function classifyRequest(raw) {
  const headEnd = raw.search(/\r?\n\r?\n/);
  const head = headEnd >= 0 ? raw.slice(0, headEnd) : raw;
  const body = headEnd >= 0 ? raw.slice(headEnd) : "";
  const isPost = /^POST\s/i.test(head);
  const ct = (/^content-type:\s*(.+)$/im.exec(head)?.[1] ?? "").toLowerCase();
  const multipart = ct.includes("multipart/form-data");
  const hasSignature = SIGNATURE.test(head) || SIGNATURE.test(body);
  let verdict = "other";
  if (isPost && multipart) verdict = hasSignature ? "php2shell-probe" : "legitimate-multipart";
  else if (isPost) verdict = "non-multipart-post";
  return { isPost, multipart, hasSignature, verdict };
}

/** Summarises POSTs in a combined-format access log by what a scoped rule would do. */
function summariseLog(file) {
  const lines = fs.readFileSync(file, "utf8").split(/\r?\n/).filter(Boolean);
  let posts = 0;
  let blocked403 = 0;
  const byIp = new Map();
  for (const l of lines) {
    // "IP - - [date] "METHOD path HTTP/x" status size ..."
    const m = /^(\S+).*?"(\S+)\s+(\S+)\s+HTTP\/[\d.]+"\s+(\d{3})/.exec(l);
    if (!m) continue;
    const [, ip, method, , status] = m;
    if (method.toUpperCase() !== "POST") continue;
    posts++;
    if (status === "403") {
      blocked403++;
      byIp.set(ip, (byIp.get(ip) ?? 0) + 1);
    }
  }
  console.log(`POST requests: ${posts}`);
  console.log(`403 on POST:   ${blocked403}` + (blocked403 ? "  (a blanket multipart rule blocks real forms too)" : ""));
  if (byIp.size) {
    const top = [...byIp].sort((a, b) => b[1] - a[1]).slice(0, 5);
    console.log("Top sources of blocked POSTs:");
    for (const [ip, n] of top) console.log(`  ${n.toString().padStart(5)}  ${ip}`);
    console.log(
      "\nAccess logs do not record request bodies, so they cannot tell the attack\n" +
        "apart from a broken checkout. Capture a few blocked requests (WAF sample,\n" +
        "mod_security audit log) and run:  node triage-403.mjs --body <file>",
    );
  }
}

function main(argv) {
  if (argv[0] === "--body") {
    const raw = argv[1] ? fs.readFileSync(argv[1], "utf8") : fs.readFileSync(0, "utf8");
    const r = classifyRequest(raw);
    const say = {
      "php2shell-probe": "PHP2Shell probe — a scoped rule SHOULD block this.",
      "legitimate-multipart": "Ordinary multipart form/upload — a blanket rule WRONGLY blocks this.",
      "non-multipart-post": "Plain POST (not multipart) — a multipart rule does not touch it.",
      other: "Not a POST request.",
    };
    console.log(`verdict: ${r.verdict}\n${say[r.verdict]}`);
    return r.verdict === "php2shell-probe" ? 1 : 0;
  }
  if (!argv[0]) {
    console.error("usage: node triage-403.mjs <access.log>   |   node triage-403.mjs --body <request.txt>");
    return 2;
  }
  summariseLog(argv[0]);
  return 0;
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  process.exitCode = main(process.argv.slice(2));
}

# Summarise the POSTs a blanket rule blocked (bodies are not in access logs)
node triage-403.mjs /var/log/nginx/access.log

# Classify one captured request as the probe or a real form
node triage-403.mjs --body blocked-request.txt   # exit 1 = probe, 0 = legitimate

verdict: legitimate-multipart
Ordinary multipart form/upload — a blanket rule WRONGLY blocks this.