Rule 951260

Description

Rule ID 951260 is doing lots of false positives, it is quite easy to trigger it. It has two conditions:

SecRule TX:sql_error_match "@eq 1" \
SecRule RESPONSE_BODY "@rx (?i)(?:Sybase message:|Warning.*sybase.*|Sybase.*Server message.*)" \

So, if response contains anything from file sql-errors.data AND contains at least one phrase which match these regexpes:

Sybase message:
Warning.*sybase.*
Sybase.*Server message.*

If you look into sql-errors.data, for example these phrases are found:

sybase
Warning
Sybase message
Sybase message:
Server message

So, in lots of cases, the rule acts as if it has only one of the conditions above. I believe one of these should be done:

• remove rule 951260
• remove phrases above from sql-errors.data (maybe some more)

Your Environment

• CRS version (e.g., v3.2.0): 3.3.0
• Paranoia level setting: PL1
• ModSecurity version (e.g., 2.9.3): 2.9.3
• Web Server and version (e.g., apache 2.4.41): 2.4
• Operating System and version: Debian Buster

Confirmation

[x] I have removed any personal data (email addresses, IP addresses, passwords, domain names) from any logs posted.

[lifeforms]

It would be awesome if you could do it @azurit , as said I am still swamped and cannot be as active as I would like.

[lifeforms]

@azurit Thanks, forgot about this one. I will make time for it in the weekend.