client9 / client9/libinjection
942100: False positive
- Dominant language
- C
- Stars
- 1k
- Forks
- 282
- PR merge metrics
- No merged PRs in 30d
Description
## False Positive
Mod security using libinjection blocks a valid request having
`[0: 006--u-m4YIaIyga-cq8yK]`
as payload.
## Description
```
ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "43"] [id "942100"] [rev "1"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: 1c found within ARGS:json.array_0: 006--u-m4YIaIyga-cq8yK"] [severity "2"] [ver "OWASP_CRS/3.0.0"] [maturity "1"] [accuracy "8"] [hostname "XXXXX"] [uri "/some/url"] [unique_id "XXXXX"] [ref "XXX"]
ModSecurity: Access denied with code 302 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "44"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "2"] [ver ""] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "XXXXX"] [uri "/some/url"] [unique_id "XXXXX"] [ref ""]
ModSecurity: Warning. Matched "Operator `Ge' with parameter `5' against variable `TX:INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf"] [line "65"] [id "980130"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): SQL Injection Attack Detected via libinjection"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [tag "event-correlation"] [hostname "XXXXX"] [uri "/some/url"] [unique_id "XXXXX"] [ref ""]
```
## Your Environment
* CRS version (v3.0.0)
* ModSecurity version (3.0.2)
* Web Server and version (Nginx 1.15.9)
From: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1416
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.