How to get around and resolve the issue with the below WAF event logs :

yyyy-mm-dd Thh:mm:ss +04:00 KEMP wafd: ModSecurity: Access denied with code 400 (phase 2). Match of "eq 0" against "REQBODY_ERROR" required. [file "/tmp/waf/xx/modsec.conf"] [line "xx"] [id "xxxxxx"] [msg "Failed to parse request body."] [data "JSON parsing error: More than 1000 JSON keys"] [severity "CRITICAL"] [hostname "xx.xx (hostname.com)"] [uri "/xxx/xxx"] [unique_id "aaaaa-bbb-cccc-dddd-eeeeeeeee"]

The error "JSON parsing error: More than 1000 JSON keys" is most likely a limitation in the WAF engine used by the LoadMaster, rather than a strict rule from the OWASP Core Rule Set (CRS).

The rules that are being triggered and causing this problem are in phase 2 (Request Body). These are built-in, non-modifiable rules as part of the core rule set (CRS) in OWASP WAF.

ModSecurity: Access denied with code 400 (phase 2) in WAF enabled Virtual Service means 
ModSecurity blocked the request during phase 2 (request body inspection). 
This usually happens because:

There are two options to resolve this issue:-

* Option 1:

Disable the Inspect HTTP POST Request Bodies-

- Under the LoadMaster's WUI -> Virtual Services -> View/Modify Services -> WAF Options -> Web Application Firewall -> WAF Options> Advanced Settings -> Inspect HTTP POST Request Bodies -> Disable this option.

WAF will send POST requests but its not required to inspect them as earlier error related to JSON parsing was being caused since Modsecurity engine was inspecting HTTP Post request bodies as well as JSON parsing requests as well that's not needed.

- We would also recommend disabling 'Enable JSON Parser' option too along with it from WAF > Advanced Settings.

- Once disabled, all xml requests will pass through and application will start function correctly, I have had success on unchecking it in the past.

* Option 2:

Create a custom rule to bypass this function (example)-

- Open a notepad and ensert the following values

- SecRule REMOTE_ADDR "@ipMatch https://url.us.m.mimecastprotect.com/s/RFTDCL9G4GHG8D2RtBfyty-klX?domain=192.1.1.101" \ id:101,phase:1,t:none,nolog,pass,ctl:ruleEngine=off

- IP Address https://url.us.m.mimecastprotect.com/s/RFTDCL9G4GHG8D2RtBfyty-klX?domain=192.1.1.101 is the source IP address of the Client

- Save file as a .conf extension

- Once created, upload rule WUI -> Web Application Firewall -> Custom Rules -> Legacy Custom Rules -> Add Custom Ruleset

Once Added, add WAF rue to Virtual Service, Virtual Services -> View/Modify Services -> WAF Options -> Web Application Firewall -> Manage Rules -> Custom Rules -> Select Custom Rule -> Apply

- Once rule is applied, all xml requests will pass through and application will start function correctly.

WAF Rule Writing Guide:

https://docs.progress.com/bundle/loadmaster-technical-note-waf-rule-writing-guide-ga/page/Introduction.html

WAF Feature Description:

https://docs.progress.com/bundle/loadmaster-feature-description-web-application-firewall-ga/page/Introduction.html

Disable/Remove WAF rule:

https://community.progress.com/s/article/How-to-disable-or-remove-a-Specific-WAF-Rule