Mod_sec rule fails with hex CR or LF in POST - http-status-code-500

Question

On a shared hosting platform, running a WordPress site with comments enabled, some comments are causing 500 errors. The server error.log file shows entries similar to this (some obfustication of path and IP address, and line breaks added for visual clarity):
[Thu Aug 12 13:38:35.782008 2021] [:error] [pid 24207:tid 3383178114816]
[client 24.113.161.xxx:59792] [client xx.xx.xx.x] ModSecurity: Warning.
Pattern match "(?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)
\\\\s+(?:\\\\/|\\\\w)[^\\\\s]*(?:\\\\s+http\\\\/\\\\d|[\\\\r\\\\n])"
at REQUEST_BODY. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "52"] [id "921110"]
[msg "HTTP Request Smuggling Attack"]
[data "Matched Data: post request.\\x0d found within REQUEST_BODY: comment=#nick - the error logs indicate that there is some hex characters embedded in the text that causes the 500 error. you may not be able to see the hex characters,
but they are recognized as a code injection attempt, which is why the server blocks them (via the mod_sec3_crs module, which interprets the pattern as being a security risk, and therefore blocks the request, which is returned as a 500 error).
\\x0d\\x0a\\x0d\\x0athe embedded characters..."]
[severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"]
[tag "paranoia- [hostname "www.ttgnet.com"]
[uri "/journal/wp-comments-post.php"] [unique_id "YRWGy9SRhtRZmIT81gkAvAAAAA8"], referer: https://example.com/journal/
Similar entries in the error log also catch the hex values for CR/LF as rule violations. Not all comment posts cause the 500 error (or entries in the server error log), but all of the errors seem to include the CR/LF hex pattern in the error message.
I am not well-versed in how mod-sec works. Where should I start to diagnose?
Added
Here's a sample complete line from the log file, with folder names anonymized:
Line 49: [Tue Sep 21 14:16:06.979253 2021] [:error] [pid 21757:tid 3479988672256] [client 38.13.110.xxx:60982] [client 38.13.110.xxx] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'son;n' [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "65"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: son;n found within ARGS:comment: \\x22Put the MP3 files in a zip archive, with a password, put the file in Dropbox, email the link in one email, password in a separate email. No postage involved. \\x22\\x0d\\x0a\\x0d\\x0a \\x0d\\x0a\\x0d\\x0aI can do that.\\xc2\\xa0 A password protected folder on my website.\\xc2\\xa0 Great idea Ray!!!\\x0d\\x0a\\x0d\\x0a "] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "www.example.com"] [uri "/folder/wp-comments-post.php"] [unique_id "YUpLllhFado5xTTGY0P7wwAAAA8"], referer: https://www.example.com/journal/post-title/
This is a comment to a WordPress post, and from a known commentor. Standard comment entry box.
Why would this be blocked - and causing a 500 error?
ADDED
Here's another error from the server error log. Note that the submitter is not a hacker (I know the person); just a commenter on the site.
[Thu Sep 23 11:43:42.440238 2021] [:error] [pid 8853:tid 3479955101440] [client 75.53.225.xxx:56406] [client 75.53.225.xxx] ModSecurity: Warning. Pattern match "(?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)\\\\s+(?:\\\\/|\\\\w)[^\\\\s]*(?:\\\\s+http\\\\/\\\\d|[\\\\r\\\\n])" at ARGS:comment. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "52"] [id "921110"] [msg "HTTP Request Smuggling Attack"] [data "Matched Data: lock home.\\x0d found within ARGS:comment: it's the people.\\xc2\\xa0 the un isn't forcing them to be dirty.\\xc2\\xa0 the clinton's removed people from the island, which should have helped (yeah, poor taste).\\x0d\\x0a\\x0d\\x0a\\xa0\\x0d\\x0a\\x0d\\x0aif they don't want to live in garbage under a bridge stay the flock home.\\x0d\\x0a\\x0d\\x0a\\xa0\\x0d\\x0a\\x0d\\x0an"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272/220/33"] [hostname "www.example.com"] [uri "/journal/wp-comments-post.php"] [unique_id "YUzK3shjwDZMxbYxHQ83EQAAAA8"], referer: https://www.example.com/journal/2021/09/23/thur-sept-23-2021-tired-but-the-weather-is-great/
[Thu Sep 23 11:43:42.440563 2021] [:error] [pid 8853:tid 3479955101440] [client 75.53.225.xxx:56406] [client 75.53.225.xxx] ModSecurity: Warning. Pattern match "(?:get|post|head|options|connect|put|delete|trace|track|patch|propfind|propatch|mkcol|copy|move|lock|unlock)\\\\s+(?:\\\\/|\\\\w)[^\\\\s]*(?:\\\\s+http\\\\/\\\\d|[\\\\r\\\\n])" at REQUEST_BODY. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-921-PROTOCOL-ATTACK.conf"] [line "52"] [id "921110"] [msg "HTTP Request Smuggling Attack"] [data "Matched Data: lock home.\\x0d found within REQUEST_BODY: comment=it's the people.\\xc2\\xa0 the un isn't forcing them to be dirty.\\xc2\\xa0 the clinton's removed people from the island, which should have helped (yeah, poor taste).\\x0d\\x0a\\x0d\\x0a\\xa0\\x0d\\x0a\\x0d\\x0aif they don't want to live in garbage under a bridge stay the flock home.\\x0d\\x0a\\x0d\\x0a\\xa0\\x0d\\x0a\\x0d\\x0an&author=nick flandrey&email=flandrey#aol.com&url=https://www.example.com/journal/&wp-comment-cookies-consent=yes&bcsb_hidden=6f29fb34-6a01..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia- [hostname "www.example.com"] [uri "/journal/wp-comments-post.php"] [unique_id "YUzK3shjwDZMxbYxHQ83EQAAAA8"], referer: https://www.example.com/journal/2021/09/23/thur-sept-23-2021-tired-but-the-weather-is-great/
[Thu Sep 23 11:43:42.458524 2021] [:error] [pid 8853:tid 3479955101440] [client 75.53.225.xxx:56406] [client 75.53.225.xxx] ModSecurity: Access denied with code 418 (phase 2). Operator GE matched 7 at TX:anomaly_score. [file "/dh/apache2/template/etc/mod_sec3_CRS/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.example.com"] [uri "/journal/wp-comments-post.php"] [unique_id "YUzK3shjwDZMxbYxHQ83EQAAAA8"], referer: https://www.example.com/journal/2021/09/23/thur-sept-23-2021-tired-but-the-weather-is-great/

Answer 1

Are you sure these are really not attack attempts?

Answer 2

You will probably need to write an exclusion rule, here's an example of very simple one which should work:
SecRule REQUEST_FILENAME "#streq /journal/wp-comments-post.php" \
"id:9990000,\
phase:1,\
pass,\
t:none,\
nolog,\
ctl:ruleRemoveTargetById=921110;ARGS:comment,\
ctl:ruleRemoveTargetById=921110;REQUEST_BODY"
Put it into file REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf .