8000 Classic SQL injection probing rule split 942370 · Issue #884 · coreruleset/coreruleset · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Classic SQL injection probing rule split 942370 #884

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
CRS-migration-bot opened this issue May 13, 2020 · 0 comments
Closed

Classic SQL injection probing rule split 942370 #884

CRS-migration-bot opened this issue May 13, 2020 · 0 comments

Comments

@CRS-migration-bot
Copy link

Issue for tracking original pull request created by user emphazer on date 2017-09-14 06:40:54.
Link to original PR: SpiderLabs/owasp-modsecurity-crs#884.

HEAD is: 764e20669a2c8246e2885abed9e5041cb934fb2b
BASE is: babbbf2
Rule 942370 has led to many false positives on a recent implementation of a CMS. Here is an extract of the POST request body that matched;

a:4:s:10:"**extension**";s:4:"Form";s:11:"**controller**";s:8:"Frontend";s:7:"**action**";s:4:"show";s:7:"**vendor**";s:9:"TYPO3\CMS";}2c0bd52d2261306ac8851dddef4bceafefab451a

This kind of payload is not out of the ordinary for certain CMS.
The only part that actually matched is ";}2c0 . It was only matched by a small portion of the regular expression, which is completely seperated from the rest of the regexp by an OR-operator.

This separation means that said part of the expression acts like a completely separate rule. That rule seems to be very sensitive. It only requires a quotation mark followed by a special character, then two random numbers that may be separated, for example "#22 would match. This seems to be too strict to include in PL2. Because of its sensitivity seems to be a perfect addition to rule 942460 , which is in PL3 and matches any four special characters in sequence.

Therefore, I would suggest splitting the rule in two and moving this sensitive part to PL3.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@CRS-migration-bot
0