Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Added libinjection SQLi rule for last path segment #1329

Closed
wants to merge 11 commits into from
Closed

Added libinjection SQLi rule for last path segment #1329

Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
3370e52
Added libinjection SQLi rule for last path segment
theseion Mar 21, 2019
4ba4096
Moved actions to chained rule
theseion Mar 21, 2019
52121b5
added missing backslash
theseion Mar 21, 2019
8722358
added missing quotes
theseion Mar 21, 2019
356fb82
Made some minor improvements to the new libinjection rule
theseion Mar 21, 2019
06c8584
Moved `multiMatch` action to chained rule
theseion Mar 21, 2019
c63ad16
Moved meta actions back to chain starter rule
theseion Mar 21, 2019
3b373c8
Removed `multiMatch` action
theseion Mar 21, 2019
ff42ca0
fixed missing quote
theseion Mar 21, 2019
f4ea7a8
Increased `tx.anomaly_score_` to level 2.
theseion Mar 21, 2019
9a517fa
Updated rules as suggested
theseion Mar 22, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1343,6 +1343,39 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|!REQUEST_COOKIES:/_pk_ref/|REQU
setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{tx.0}'"


#
# -=[ LibInjection Check on last path segment ]=-
#
# This is a sibling of rule 942100 that adds checking of the last path segment.
#
SecRule REQUEST_FILENAME "@rx ^/(.*)$"
"id:942101,\
phase:2,\
block,\
capture,\
t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls,\
msg:'SQL Injection Attack Detected via libinjection',\
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
tag:'application-multi',\
tag:'language-multi',\
tag:'platform-multi',\
tag:'attack-sqli',\
tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
tag:'WASCTC/WASC-19',\
tag:'OWASP_TOP_10/A1',\
tag:'OWASP_AppSensor/CIE1',\
tag:'PCI/6.5.2',\
tag:'paranoia-level/2',\
ver:'OWASP_CRS/3.1.0',\
severity:'CRITICAL',\
multiMatch,\
setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
setvar:'tx.msg=%{rule.msg}',\
setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQL_INJECTION-%{MATCHED_VAR_NAME}=%{MATCHED_VAR}',\
chain"
SecRule TX:1 "@detectSQLi"
Copy link
Contributor

@theMiddleBlue theMiddleBlue Mar 21, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

missing action on the chained SecRule (3rd argument)

Copy link
Author

@theseion theseion Mar 21, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. I've just pushed a commit where the setvar actions have been moved to the chained rule, as they would be evaluated every time otherwise.

I thought about putting the rule in PL1 but I don't know what the implications are for FP's.



SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:942015,phase:1,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
SecRule TX:EXECUTING_PARANOIA_LEVEL "@lt 3" "id:942016,phase:2,pass,nolog,skipAfter:END-REQUEST-942-APPLICATION-ATTACK-SQLI"
Expand Down