FP 942360: resolves issue #997 and #988

rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf

@@ -454,6 +454,17 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
     setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
     setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}'"
 
+# This rule has a stricter sibling: 942361.
+# The keywords 'alter' and 'union' led to false positives.
+# Therefore they have been moved to PL2 and the keywords have been extended on PL1.
+#
+# Sources for SQL ALTER statements:
+# MySQL: https://dev.mysql.com/doc/refman/5.7/en/sql-syntax-data-definition.html
+# Oracle/PLSQL: https://docs.oracle.com/apps/search/search.jsp?q=alter&size=60&category=database
+# PostgreQSL: https://www.postgresql.org/search/?u=%2Fdocs&q=alter
+# MSSQL: https://docs.microsoft.com/en-us/sql/t-sql/statements/statements
+# DB2: https://www.ibm.com/support/knowledgecenter/en/search/alter?scope=SSEPGG_9.5.0
+#
 # Regexp generated from util/regexp-assemble/regexp-942360.data using Regexp::Assemble.
 # To rebuild the regexp:
 #   cd util/regexp-assemble
@@ -462,7 +473,7 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
 # to the Regexp::Assemble output:
 #   (?i:ASSEMBLE_OUTPUT)
 #
-SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:(?:(?:(?:trunc|cre|upd)at|renam)e|(?:inser|selec)t|de(?:lete|sc)|alter|load)\s+(?:group_concat|load_file|char)\s?\(?|^[\W\d]+\s*?(?:(?:(?:trunc|cre)at|renam)e|(?:inser|selec)t|u(?:pdate|nion)|de(?:lete|sc)|alter|load)\b|[\d\W]\s+as\s*?[\"'`\w]+\s*?from|[\s(]load_file\s*?\(|[\"'`]\s+regexp\W|end\s*?\);))" \
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:(?:^[\W\d]+\s*?(?:alter\s*(?:a(?:(?:pplication\s*rol|ggregat)e|s(?:ymmetric\s*ke|sembl)y|u(?:thorization|dit)|vailability\s*group)|c(?:r(?:yptographic\s*provider|edential)|o(?:l(?:latio|um)|nversio)n|ertificate|luster)|s(?:e(?:rv(?:ice|er)|curity|quence|ssion|arch)|y(?:mmetric\s*key|nonym)|togroup|chema)|m(?:a(?:s(?:ter\s*key|k)|terialized)|e(?:ssage\s*type|thod)|odule)|l(?:o(?:g(?:file\s*group|in)|ckdown)|a(?:ngua|r)ge|ibrary)|t(?:(?:abl(?:espac)?|yp)e|r(?:igger|usted)|hreshold|ext)|p(?:a(?:rtition|ckage)|ro(?:cedur|fil)e|ermission)|d(?:i(?:mension|skgroup)|atabase|efault|omain)|r(?:o(?:l(?:lback|e)|ute)|e(?:sourc|mot)e)|f(?:u(?:lltext|nction)|lashback|oreign)|e(?:xte(?:nsion|rnal)|(?:ndpoi|ve)nt)|in(?:dex(?:type)?|memory|stance)|b(?:roker\s*priority|ufferpool)|x(?:ml\s*schema|srobject)|w(?:ork(?:load)?|rapper)|hi(?:erarchy|stogram)|o(?:perator|utline)|(?:nicknam|queu)e|us(?:age|er)|group|java|view)|u(?:nion\s*(?:(?:distin|sele)ct|all)|pdate)|(?:(?:trunc|cre)at|renam)e|(?:inser|selec)t|de(?:lete|sc)|load)\b|(?:(?:(?:trunc|cre|upd)at|renam)e|(?:inser|selec)t|de(?:lete|sc)|alter|load)\s+(?:group_concat|load_file|char)\s?\(?|[\d\W]\s+as\s*?[\"'`\w]+\s*?from|[\s(]load_file\s*?\(|[\"'`]\s+regexp\W|end\s*?\);))" \
     "id:942360,\
     phase:2,\
     block,\
@@ -929,6 +940,44 @@ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAME
     setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
     setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}'"
 
+# This rule is a stricter sibling of 942360.
+# The keywords 'alter' and 'union' led to false positives.
+# Therefore they have been moved to PL2 and the keywords have been extended on PL1.
+#
+# Regexp generated from util/regexp-assemble/regexp-942361.data using Regexp::Assemble.
+# To rebuild the regexp:
+#   cd util/regexp-assemble
+#   ./regexp-assemble.pl regexp-942361.data
+# Note that after assemble an outer bracket with an ignore case flag is added
+# to the Regexp::Assemble output:
+#   (?i:ASSEMBLE_OUTPUT)
+#
+SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i:^[\W\d]+\s*?(?:alter|union)\b)" \
+    "id:942361,\
+    phase:2,\
+    block,\
+    capture,\
+    t:none,t:urlDecodeUni,\
+    msg:'Detects basic SQL injection based on keyword alter or union',\
+    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
+    tag:'application-multi',\
+    tag:'language-multi',\
+    tag:'platform-multi',\
+    tag:'attack-sqli',\
+    tag:'OWASP_CRS/WEB_ATTACK/SQL_INJECTION',\
+    tag:'WASCTC/WASC-19',\
+    tag:'OWASP_TOP_10/A1',\
+    tag:'OWASP_AppSensor/CIE1',\
+    tag:'PCI/6.5.2',\
+    tag:'paranoia-level/2',\
+    rev:2,\
+    ver:'OWASP_CRS/3.0.0',\
+    severity:'CRITICAL',\
+    setvar:'tx.msg=%{rule.msg}',\
+    setvar:'tx.sql_injection_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.anomaly_score=+%{tx.critical_anomaly_score}',\
+    setvar:'tx.%{rule.id}-OWASP_CRS/WEB_ATTACK/SQLI-%{matched_var_name}=%{tx.0}'"
+
 # This rule is a sibling of 942330. See that rule for a description and overview.
 # Regexp generated from util/regexp-assemble/regexp-942370.data using Regexp::Assemble.
 # To rebuild the regexp:

util/regexp-assemble/regexp-942360.data

@@ -32,7 +32,6 @@ end\s*?\);
 [\s(]load_file\s*?\(
 [\"'`]\s+regexp\W
 [\d\W]\s+as\s*?[\"'`\w]+\s*?from
-^[\W\d]+\s*?alter\b
 ^[\W\d]+\s*?create\b
 ^[\W\d]+\s*?delete\b
 ^[\W\d]+\s*?desc\b
@@ -41,5 +40,95 @@ end\s*?\);
 ^[\W\d]+\s*?rename\b
 ^[\W\d]+\s*?select\b
 ^[\W\d]+\s*?truncate\b
-^[\W\d]+\s*?union\b
 ^[\W\d]+\s*?update\b
+^[\W\d]+\s*?alter\s*aggregate\b
+^[\W\d]+\s*?alter\s*application\s*role\b
+^[\W\d]+\s*?alter\s*assembly\b
+^[\W\d]+\s*?alter\s*asymmetric\s*key\b
+^[\W\d]+\s*?alter\s*audit\b
+^[\W\d]+\s*?alter\s*authorization\b
+^[\W\d]+\s*?alter\s*availability\s*group\b
+^[\W\d]+\s*?alter\s*broker\s*priority\b
+^[\W\d]+\s*?alter\s*bufferpool\b
+^[\W\d]+\s*?alter\s*certificate\b
+^[\W\d]+\s*?alter\s*cluster\b
+^[\W\d]+\s*?alter\s*collation\b
+^[\W\d]+\s*?alter\s*column\b
+^[\W\d]+\s*?alter\s*conversion\b
+^[\W\d]+\s*?alter\s*credential\b
+^[\W\d]+\s*?alter\s*cryptographic\s*provider\b
+^[\W\d]+\s*?alter\s*database\b
+^[\W\d]+\s*?alter\s*default\b
+^[\W\d]+\s*?alter\s*dimension\b
+^[\W\d]+\s*?alter\s*diskgroup\b
+^[\W\d]+\s*?alter\s*domain\b
+^[\W\d]+\s*?alter\s*endpoint\b
+^[\W\d]+\s*?alter\s*extension\b
+^[\W\d]+\s*?alter\s*external\b
+^[\W\d]+\s*?alter\s*event\b
+^[\W\d]+\s*?alter\s*flashback\b
+^[\W\d]+\s*?alter\s*foreign\b
+^[\W\d]+\s*?alter\s*fulltext\b
+^[\W\d]+\s*?alter\s*function\b
+^[\W\d]+\s*?alter\s*hierarchy\b
+^[\W\d]+\s*?alter\s*group\b
+^[\W\d]+\s*?alter\s*histogram\b
+^[\W\d]+\s*?alter\s*index\b
+^[\W\d]+\s*?alter\s*indextype\b
+^[\W\d]+\s*?alter\s*inmemory\b
+^[\W\d]+\s*?alter\s*instance\b
+^[\W\d]+\s*?alter\s*java\b
+^[\W\d]+\s*?alter\s*language\b
+^[\W\d]+\s*?alter\s*large\b
+^[\W\d]+\s*?alter\s*library\b
+^[\W\d]+\s*?alter\s*lockdown\b
+^[\W\d]+\s*?alter\s*logfile\s*group\b
+^[\W\d]+\s*?alter\s*login\b
+^[\W\d]+\s*?alter\s*mask\b
+^[\W\d]+\s*?alter\s*master\s*key\b
+^[\W\d]+\s*?alter\s*materialized\b
+^[\W\d]+\s*?alter\s*message\s*type\b
+^[\W\d]+\s*?alter\s*method\b
+^[\W\d]+\s*?alter\s*module\b
+^[\W\d]+\s*?alter\s*nickname\b
+^[\W\d]+\s*?alter\s*operator\b
+^[\W\d]+\s*?alter\s*outline\b
+^[\W\d]+\s*?alter\s*package\b
+^[\W\d]+\s*?alter\s*partition\b
+^[\W\d]+\s*?alter\s*permission\b
+^[\W\d]+\s*?alter\s*procedure\b
+^[\W\d]+\s*?alter\s*profile\b
+^[\W\d]+\s*?alter\s*queue\b
+^[\W\d]+\s*?alter\s*remote\b
+^[\W\d]+\s*?alter\s*resource\b
+^[\W\d]+\s*?alter\s*role\b
+^[\W\d]+\s*?alter\s*rollback\b
+^[\W\d]+\s*?alter\s*route\b
+^[\W\d]+\s*?alter\s*schema\b
+^[\W\d]+\s*?alter\s*search\b
+^[\W\d]+\s*?alter\s*security\b
+^[\W\d]+\s*?alter\s*server\b
+^[\W\d]+\s*?alter\s*service\b
+^[\W\d]+\s*?alter\s*sequence\b
+^[\W\d]+\s*?alter\s*session\b
+^[\W\d]+\s*?alter\s*symmetric\s*key\b
+^[\W\d]+\s*?alter\s*synonym\b
+^[\W\d]+\s*?alter\s*stogroup\b
+^[\W\d]+\s*?alter\s*table\b
+^[\W\d]+\s*?alter\s*tablespace\b
+^[\W\d]+\s*?alter\s*text\b
+^[\W\d]+\s*?alter\s*threshold\b
+^[\W\d]+\s*?alter\s*trigger\b
+^[\W\d]+\s*?alter\s*trusted\b
+^[\W\d]+\s*?alter\s*type\b
+^[\W\d]+\s*?alter\s*usage\b
+^[\W\d]+\s*?alter\s*user\b
+^[\W\d]+\s*?alter\s*view\b
+^[\W\d]+\s*?alter\s*work\b
+^[\W\d]+\s*?alter\s*workload\b
+^[\W\d]+\s*?alter\s*wrapper\b
+^[\W\d]+\s*?alter\s*xml\s*schema\b
+^[\W\d]+\s*?alter\s*xsrobject\b
+^[\W\d]+\s*?union\s*all\b
+^[\W\d]+\s*?union\s*select\b
+^[\W\d]+\s*?union\s*distinct\b

util/regexp-assemble/regexp-942361.data

@@ -0,0 +1,2 @@
+^[\W\d]+\s*?alter\b
+^[\W\d]+\s*?union\b