Modsecurity - redirect loop for "Host header is a numeric IP address" error

It looks like there is a ModSecurity OWASP rule, that when it detects someone accessing your site via the IP address instead of the DNS name, instead of denying with a 4xx error, it simply redirects back to the "homepage". The problem is it's redirecting back to the IP address, which causes the same error to trigger again, and you get a redirect loop.

Is there a way to specify what action to take for a specific rule?

The rule is as follows.. And I don't see any redirect options or even any option to specify a specific error.

SecRule REQUEST_HEADERS:Host "^[\d.:]+$" \
  "msg:'Host header is a numeric IP address',\
   phase:request,\
   rev:'2',\
   ver:'OWASP_CRS/3.0.0',\
   maturity:'9',\
   accuracy:'9',\
   t:none,\
   block,\
   logdata:'%{matched_var}',\
   severity:'WARNING',\
   id:'920350',\
   tag:'application-multi',\
   tag:'language-multi',\
   tag:'platform-multi',\
   tag:'attack-protocol',\
   tag:'OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST',\
   tag:'WASCTC/WASC-21',\
   tag:'OWASP_TOP_10/A7',\
   tag:'PCI/6.5.10',\
   tag:'http://technet.microsoft.com/en-us/magazine/2005.01.hackerbasher.aspx',\
   setvar:'tx.msg=%{rule.msg}',\
   setvar:tx.anomaly_score=+%{tx.warning_anomaly_score},\
   setvar:tx.%{rule.id}-OWASP_CRS/POLICY/IP_HOST-%{matched_var_name}=%{matched_var}"

and the error log...

--46372f1f-A--
[04/Jun/2016:19:10:43 --0500] V1NuA38AAAEAACCaOHwAAAAR xxx.xxx.xxx.xxx 60414 172.31.41.204 80
--46372f1f-B--
GET / HTTP/1.1
Host: 52.24.56.241
Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8

--46372f1f-F--
HTTP/1.1 302 Found
Location: http://52.24.56.241/
Content-Length: 204
Keep-Alive: timeout=5, max=80
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

--46372f1f-E--
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>iT LOO
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://52.24.56.241/">here</a>.</p>
</body></html>

--46372f1f-H--
Message: Access denied with redirection to http://52.24.56.241/ using status 302 (phase 2). Pattern match "^[\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/activated_rules/REQUEST-20-PROTOCOL-ENFORCEMENT.conf"] [line "840"] [id "920350"] [rev "2"] [msg "Host header is a numeric IP address"] [data "52.24.56.241"] [severity "WARNING"] [ver "OWASP_CRS/3.0.0"] [maturity "9"] [accuracy "9"] [tag "Host: 52.24.56.241"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/IP_HOST"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [tag "http://technet.microsoft.com/en-us/magazine/2005.01.hackerbasher.aspx"]
Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client %s] ModSecurity: %s%s [uri "%s"]%s
Action: Intercepted (phase 2)
Stopwatch: 1465085443076841 1107 (- - -)
Stopwatch2: 1465085443076841 1107; combined=684, p1=288, p2=198, p3=0, p4=0, p5=153, sr=69, sw=45, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/); OWASP_CRS/3.0.0.
Server: Apache
Engine-Mode: "ENABLED"

How does ModSecurity decide which action to take?
How can I tell ModSecurity to stop a redirect loop for this error?

Solution

In the event of a deny or "block" rule, ModSecurity will look for the SecDefaultAction directive in the modsecurity_crs_10_setup.conf file. For OWASP_CRS 3.0.0-rc1, this directive changed from

SecDefaultAction "phase:1,deny,log"
SecDefaultAction "phase:2,deny,log"

SecDefaultAction "phase:1,log,redirect:'http://%{request_headers.host}/',tag:'Host: %{request_headers.host}'"
SecDefaultAction "phase:2,log,redirect:'http://%{request_headers.host}/',tag:'Host: %{request_headers.host}'"

This is what is causing the re-direct, the rule says block, so it looks for the default action, and the default action is to redirect to the HOST... Which in this case is just the IP already being specified... And there is the redirect loop...

Please note, this rule will fire BEFORE Apache has a chance to serve up the appropriate Virtual Host to respond to this request.

To override this rule (for 3.0.0-rc1) you need to modify the RESPONSE-99-EXCEPTIONS.conf file and add something along the lines of..

SecRuleUpdateActionById 920350 "deny,status:403"

This will deny the request. or if you would rather allow it..

SecRuleUpdateActionById 920350 "pass"