Description
The SQL Injection detection rule 942100 fails to detect basic SQLi payloads when they are URL-encoded (e.g., %27OR%201=1). The rule currently uses t:urlDecodeUni but lacks t:urlDecode, which is necessary for decoding standard %XX URL encodings before the libinjection operator evaluates the payload.
This results in legitimate SQL Injection attempts passing through the WAF undetected.
Steps to reproduce
Deploy Coraza with OWASP CRS (v4.26.0) and rule 942100 using the default transformation order:
text
t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls
Send a GET request with a URL-encoded SQL Injection payload:
text
GET /?a=%27OR%201=1 HTTP/1.1
Host: example.com
Check the audit logs for rule 942100.
Observe that the request is not blocked and no Matched Data is captured.
Expected result
The request should be blocked with status 403, and the audit log should contain:
text
Matched Data: 'OR 1=1 found within ARGS:a: 'OR 1=1
Actual result
The request is allowed through the WAF. The audit log shows:
text
Matched Data: found within ARGS:a: %27OR%201=1
or no match at all, because libinjection receives the encoded value (%27OR%201=1) instead of the decoded payload ('OR 1=1).
FIX rules:
SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@detectSQLi"
"id:942100,
phase:2,
block,
capture,
t:none,t:urlDecode,t:urlDecodeUni,t:utf8toUnicode,t:removeNulls,
msg:'SQL Injection Attack Detected via libinjection',
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',
tag:'application-multi',
tag:'language-multi',
tag:'platform-multi',
tag:'attack-sqli',
tag:'paranoia-level/1',
tag:'OWASP_CRS',
tag:'OWASP_CRS/ATTACK-SQLI',
tag:'capec/1000/152/248/66',
ver:'OWASP_CRS/4.26.0',
severity:'CRITICAL',
multiMatch,
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"
Description
The SQL Injection detection rule 942100 fails to detect basic SQLi payloads when they are URL-encoded (e.g., %27OR%201=1). The rule currently uses t:urlDecodeUni but lacks t:urlDecode, which is necessary for decoding standard %XX URL encodings before the libinjection operator evaluates the payload.
This results in legitimate SQL Injection attempts passing through the WAF undetected.
Steps to reproduce
Deploy Coraza with OWASP CRS (v4.26.0) and rule 942100 using the default transformation order:
text
t:none,t:utf8toUnicode,t:urlDecodeUni,t:removeNulls
Send a GET request with a URL-encoded SQL Injection payload:
text
GET /?a=%27OR%201=1 HTTP/1.1
Host: example.com
Check the audit logs for rule 942100.
Observe that the request is not blocked and no Matched Data is captured.
Expected result
The request should be blocked with status 403, and the audit log should contain:
text
Matched Data: 'OR 1=1 found within ARGS:a: 'OR 1=1
Actual result
The request is allowed through the WAF. The audit log shows:
text
Matched Data: found within ARGS:a: %27OR%201=1
or no match at all, because libinjection receives the encoded value (%27OR%201=1) instead of the decoded payload ('OR 1=1).
FIX rules:
SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|REQUEST_HEADERS:User-Agent|REQUEST_HEADERS:Referer|ARGS_NAMES|ARGS|XML:/* "@detectSQLi"
"id:942100,
phase:2,
block,
capture,
t:none,t:urlDecode,t:urlDecodeUni,t:utf8toUnicode,t:removeNulls,
msg:'SQL Injection Attack Detected via libinjection',
logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',
tag:'application-multi',
tag:'language-multi',
tag:'platform-multi',
tag:'attack-sqli',
tag:'paranoia-level/1',
tag:'OWASP_CRS',
tag:'OWASP_CRS/ATTACK-SQLI',
tag:'capec/1000/152/248/66',
ver:'OWASP_CRS/4.26.0',
severity:'CRITICAL',
multiMatch,
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}',
setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}'"