942450 (CRS3) SQL Hex Encoding Identified

[dune73]

The rule 942450 includes REQUEST_COOKIES in PL1. That's basically fine, but at times you get a session cookie which contains a string looking like a hexencoded string, when it's not. A classical case of a false positive.

Possible remedies:
(1) Whitelist cookies that resemble session cookies. Exclude names containing "SESS" like JSESSIONID but also MYSAPSSO2.
(2) Remove REQUEST_COOKIES from PL1 and add a strict sibling with REQUEST_COOKIES in PL2.

We are already excluding a few cookies by name in 942450. Still, it feels a bit hacky. So I would generally propose to go with variant 2.

[csanders-git]

Wasn't this in your presentation?

[dune73]

Yes exactly. But I never opened an issue.

Now I am seeing the FPs again...

[lifeforms]

The list of FPs I have with this rule is endless. Especially REQUEST_COOKIES and REQUEST_COOKIES_NAMES.

• WordPress triggers it, with varying cookie names: N0X5d1 found within REQUEST_COOKIES:wordpress_1465[...]
• Some common ad tracker uses it, because I have seen this on a LOT of domains: REQUEST_COOKIES_NAMES:0xaf816[...]__ipm=[...]
• Paypal txn_ids
• Symfony CSRF tokens

This is definitely low hanging fruit for FP reduction.

Question is how necessary the rule is. As far as I know, you can replace SQL literals/table names with hex, but not SQL keywords. I suspect this rule is not essential for our detection, but just another heuristic. Though, maybe because hex works without quotes/backquotes, using hex might evade some other rules. I would say the chance of a complete bypass by this is probably low, but I don't have intimate knowledge of the SQLi rules. I could be wrong about this though. It's probably easy to evade this rule too, just by using the original literal/table name instead. All in all, this rule is not my best friend.

Unless we get new evidence of its usefulness I vote for variant 2 to move the rule to PL2 altogether.

[dune73]

Would pushing the whole rule to PL 2 or 3 be a suitable variant 3?

[lifeforms]

Oh. I was so busy ranting that I misread your comment. I've given you a party to compensate for this. Yeah, that would be variant 3: move it to PL2. Because it's definitely not only cookies where I see lots of problems. But, if we're scared of totally removing it, variant 2 (excluding REQUEST_COOKIES|REQUEST_COOKIES_NAMES and check those only in PL2) would be my second favorite.

[lifeforms]

Decided: move REQUEST_COOKIES|REQUEST_COOKIES_NAMES check to a sibling in PL2.

[dune73]

OK, this looks very stupid now, but 942450 is already at PL2 - and was all along since March.

Actually, I wondered why the FPs have been far fewer than I expected for this rule. ;)

I take it we can close this issue then. If it is going too much on our nerves we can push REQUEST_COOKIES|REQUEST_COOKIES_NAMES in the future.

[lifeforms]

Classic.