Script error on specific requests (Nginx)

[koralfx]

I have found 2 cases so far.

Access nginx log:

174.138.61.44 - - [19/Jun/2024:02:50:09 +0000] "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 157 "-" "-"
13.88.8.154 - - [19/Jun/2024:03:58:35 +0000] "MGLNDD_SERVER_IP_443" 400 157 "-" "-"

Error nginx log (I hid the full file paths):

2024/06/18 23:35:21 [error] 31834#31834: *1240 FastCGI sent in stderr: "PHP message: PHP Fatal error:  Uncaught Exception: Error parsing line, check offset and limits in KnuckleLog.php:108
Stack trace:
#0 KnuckleLog.php(144): KnuckleLog->parse()
#1 index.php(line_number): KnuckleLog->worker()
#2 {main}
  thrown in KnuckleLog.php on line 108" while reading response header from upstream, client: my_ip, server: xxx.com, request: "GET /nLOGfinder/ HTTP/1.1", upstream: "fastcgi://unix:/run/php/php8.1-fpm.sock:", host: "g>

[koralfx]

Temporary workaround [in 19]:

'%r' => '(?P<request>(.*))',

However, it will probably be useful to run Nginx WAF independently.

[globalmac]

Hi @koralfx!

Thanks for your case and log sample. As soon as I have free time, I will analyze it in more detail.