SQLi rule 942410 could be revised

_Issue originally created by user franbuehler on date 2017-06-14 11:31:18. Link to original issue: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/811._

While disassembling the SQLi rule 942410 for issue #761 I noticed that the regexp could be revised. The regexp does not seem to have been written in one step, the optimization does not seem consistent. For example the strings isnull( and ifnull( are checked twice. It’s searched for if benchmark( and benchmark( at two different locations. That sounds a bit suspicious.

I disassembled the rule and listed all the strings, which could match. Of course I can not assure, that I catched all strings. But I can assure that all listed strings are in the original regexp.

As you see some of the words must be followed by an opening bracket (, some don’t. I’m not a sqli pro and I don’t know if everything is correct.

I now should test if I catched all strings while disassembling. But I’m not quite sure, how to do that. If I did and all looks good, we could reassemble the regexp and we would have the source for a list in util/regexp-assemble/regexp-942410.data.

Block 1: These strings match, if they are followed by an opening bracket (: Until my PR #791 they didn’t start with a \b.

\b(stddev|stddev_pop|stddev_samp|str_to_date|strcmp|substr|substring|substring_index|subdate|
subtime|sum|sec_to_time|second|session_user|system_user|sysdate|sha|sha1|sha2|soundex|schema|
sign|sin|space|sqrt|isnull|is_free_lock|is_ipv4_compat|is_ipv4_mapped|is_ipv4|is_ipv6|
is_not_null|is_not|is_null|is_used_lock|inet_aton|inet_ntoa|inet6_aton|inet6_ntoa|insert|
instr|interval|if|ifnull|uncompress|uncompressed_length|unix_timestamp|unhex|utc_date|
utc_time|utc_timestamp|updatexml|upper|uuid|uuid_short|ucase|user|local|localtimestamp|
locate|log|log2|log10|load_file|lower|last|last_day|last_insert_id|least|left|length|
lcase|ltrim|lpad|ln|time|timestamp|timestampadd|timestampdiff|timediff|time_format|
time_to_sec|to_base64|to_days|to_seconds|to_nchar|to_char|truncate|trim|tan|make_set|
makedate|master_pos_wait|max|mid|microsecond|min|minute|month|monthname|mod|md5|
replace|repeat|release_lock|reverse|row_count|round|radians|rand|right|rtrim|rpad|field|
field_in_set|find_in_set|from_base64|from_days|from_unixtime|found_rows|format|floor|
aes_decrypt|aes_encrypt|ascii|asciistr|ain|adddate|addtime|acos|abs|atan|atan2|avg|
position|pow|power|period_add|period_diff|procedure_analyse|password|pi|bit_length|
bit_count|bit_or|bit_xor|bit_and|bin|bin_to_num|benchmark|exp|export_set|extract|
extractvalue|encrypt|encode|elt|var_samp|var_pop|variance|values|version|group_concat|
greatest|get_format|get_lock|ord|old_password|oct|octet_length|week|weekday|weekofyear|
weight_string|not_in|now|name_const|nullif|rawtonhex|hex|rawtonhextoraw|hextoraw|quarter|
quote|pg_sleep|sleep|year|yearweek|dcount|count|xmltype|hour|cast|
current_time|current_timestamp|current_date|current_user|curdate|curtime|char|
character_length|char_length|charset|chr|ciel|cieling|cast|cr32|convert|
convert_tz|conv|concat|concat_ws|connection_id|compress|cos|coercibility|coalesce|cot|
date|date_add|date_format|date_sub|datediff|database|day|dayname|dayofmonth|
dayofweek|dayofyear|des_decrypt|des_encrypt|default|degrees|decode|dump
)\W*?\(

Block 2: These following strings match whithout any other character, allone. But each word starts and ends with \b:

sp_sqlexec|sp_replwritetovarbin|sp_help|sp_addextendedproc|sp_is_srvrolemember|
sp_prepare|sp_password|sp_execute|sp_executesql|sp_makewebtask|sp_oacreate|
sql_longvarchar|sql_variant|xp_regremovemultistring|xp_regread|xp_regdeletevalue|
xp_regdeletekey|xp_regenumvalues|xp_regenumkeys|xp_regaddmultistring|xp_regwrite|
xp_terminate|xp_servicecontrol|xp_ntsec_enumdomains|xp_terminate_process|
xp_execresultset|xp_enumdsn|xp_availablemedia|xp_loginconfig|xp_cmdshell|xp_filelist|
xp_dirtree|xp_makecab|xp_ntsec|utl_file|utl_http|dba_users|dbms_java|openrowset|
openowa_util|openquery|varchar|nvarchar|tbcreator|autonomous_transaction 

Block 3: Other combinations of more words:

collation\W*?\(a\b|
\bload\b\W*?\bdata\b.*?\binfile\b|
\bdelete\b\W*?\bfrom\b|
\bgroup\b.*?\bby\b.{1,100}?\bhaving\b|
\bunion\b.{1,100}?\bselect\b|
\bselect\b.{1,100}?\blength\b.{1,100}?\bfrom\b|
\bselect\b.{1,100}?\bcount\b.{1,100}?\bfrom\b|
\bselect\b.{1,100}?\btop\b.{1,100}?\bfrom\b|
\bselect\b.{1,100}?\bfrom\b.{1,100}?\bwhere\b|
\bselect\b.{1,100}?\b.*?\bdump\b.*\bfrom\b|
\bselect\b.{1,100}?\bdata_type\b|
\bselect\b.{1,100}?\bto_number\b|
\bselect\b.{1,100}?\bto_char\b|
\bselect\b.{1,100}?\binstr\b|
\binto\b\W*?\bdumpfile\b|
\binto\b\W*?\boutfile\b|
\binner\b\W*?\bjoin)\b|
\binsert\b\W*?\binto\b
\bprint\b\W*?\@\@|
;\W*?\bshutdown\b|
;\W*?\bdrop\b|
\@\**version**\b|
\butl_inaddr\b|
\bsys_context\b|
'sqloledb'|
'sa'|
'msdasql'|
'dbo'|
\bdbms_\w+\.\b

[CRS-migration-bot]

User franbuehler commented on date 2017-07-03 20:51:56:

As discussed in the chat tonight: I will do a PR to split this rule for 3.1.

[CRS-migration-bot]

User franbuehler commented on date 2017-12-20 21:49:25:

This issue is resolved and could be closed. The former rule id 942410 was split into three new rules: 942410, 942470, 942480 in PR #907.