sql injection – owasp-crs rule 942330 Regex – Potential False Positive
I’m investigating a WAF block triggered by OWASP CRS Rule 942330 (SQL Injection Attack Detected). The environment was running CRS 3.2, but the relevant regex appears unchanged in later versions.
My question is specifically about the regex behaviour.
The regex that matched it is for SQL injection, and it matches an apostrophe, a sql term, another word character and a comma. The word character is what’s confusing me, so it would match ‘Oro, but not ‘OR(1=1).
CoPilot tells me it’s intentional to avoid false positives, but it seem like all it does is generate false positives?
This screenshot does a better job of showing what’s matched or not, but here are simplified test cases (✔️ = matches the regex, ❌ = does not):
- c0:-1;…,Phil Del’ OR ‘a’=’a’,Date ❌
- c0:-1;…,Phil Del’ OR’a’=’a’,Date ❌
- c0:-1;…,Phil Del’ OR,Date ❌
- c0:-1;…,Phil Del’ OR ,Date ❌
- c0:-1;…,Phil Del’ OR a,Date ✔️
- c0:-1;…,Phil Del’ OR(1=1),Date ❌
- c0:-1;…,Phil Del’ OR (1=1),Date ❌
- c0:-1;…,Phil Del’ OR 1=1,Date ✔️
- c0:-1;…,Phil Del’ ORa,Date ✔️
- c0:-1;…,Phil Del’ORa,Date ✔️
- c0:-1;…,Phil Del’ AND,Date ❌
- c0:-1;…,Phil Del’ ANDa,Date ✔️
- c0:-1;…,Phil Del’ AND1,Date ✔️
- c0:-1;…,Phil Del’ ANDa-,Date ✔️
- c0:-1;…,Phil Del’ ANDY,Date ✔️
- c0:-1;…,Phil Del’ BETWEEN,Date ❌
- c0:-1;…,Phil Del’ BETWEENa,Date ✔️
Read more here: Source link