False Positive: SLQI 942360 block too sensitive

Description

Seems like it just does not like the word select in a sentence, threat detection not very good in this case seeing regular uses of the word in a sentence vs SQLI. Did check 3.3 changelog and don’t see anything in it that would have corrected this case I don’t think.

[file "/usr/local/owasp-modsecurity-crs-3.2.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "464"] [id "942360"] [rev ""] [msg "Detects concatenated basic SQL injection and SQLLFI attempts"]

Audit Logs / Triggered Rule Numbers

JSON Body:

{
  "kind": "notification",
  "body": {
    "message": "Scroll down to the forms and resources section of the page and expand other resources.\n4. Select Medicare Plan Appeals and Grievances form online\n5. Select start new form.",
    "contentType": "text/plain"
  }
}

[data "Matched Data: 4. Select found within ARGS:json.body.message: Scroll down to the forms and resources section of the page and expand other resources.\n4. Select Medicare Plan Appeals and Grievances form online\n5. Select start new form."] [severity "2"] [ver "OWASP_CRS/3.2.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "OWASP_CRS/WEB_ATTACK/SQL_INJECTION"] [tag "WASCTC/WASC-19"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/CIE1"] [tag "PCI/6.5.2"]

Your Environment

• CRS version (e.g., v3.2.0): 3.2.0
• Paranoia level setting: 1
• ModSecurity version: 3.0.4
• Web Server and version: nginx
• Operating System and version: alpine linux

Confirmation

[X] I have removed any personal data (email addresses, IP addresses, passwords, domain names) from any logs posted.

[dune73]

Hey @jeremyjpj0916, good to see you around.

I have good news: This FP is already fixed in dev. I’m thus closing this here.

I checked on 3.3.2 as well; there it is present.

[airween]

@airween Long time no see friend!

😃

Yep thats what I ended up doing, just wish the rules could be better written to avoid false positives

this regex has built, not “written”: see 942360.data, and the instructions.

That’s why we can’t “write” other than there is.

# false positive on Select phrase in a sentence.
SecRule REQUEST_URI "@contains /api-resource/v" \
    "id:44,\
    phase:1,\
    t:none,\
    pass,\
    nolog,\
    ctl:ruleRemoveById=942360"

IMHO using of ctl:ruleRemoveTargetById=942360;ARGS:json.body.message makes tighter exclusion.