# ------------------------------------------------------------------------ # OWASP ModSecurity Core Rule Set ver.3.0.2 # Copyright (c) 2006-2016 Trustwave and contributors. All rights reserved. # # The OWASP ModSecurity Core Rule Set is distributed under # Apache Software License (ASL) version 2 # Please see the enclosed LICENSE file for full details. # ------------------------------------------------------------------------ # # -= Paranoia Level 0 (empty) =- (apply unconditionally) # SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:3,id:951011,nolog,pass,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL" SecRule TX:PARANOIA_LEVEL "@lt 1" "phase:4,id:951012,nolog,pass,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL" # # -= Paranoia Level 1 (default) =- (apply only when tx.paranoia_level is sufficiently high: 1 or higher) # # # -=[ SQL Error Leakages ]=- # # Ref: https://raw.github.com/sqlmapproject/sqlmap/master/xml/errors.xml # Ref: https://github.com/Arachni/arachni/tree/master/modules/audit/sqli/patterns # SecRule RESPONSE_BODY "@pmFromFile sql-errors.data" "phase:response, id:951100, rev:'5', ver:'OWASP_CRS/3.0.0', pass, nolog, tag:'application-multi', tag:'language-multi', tag:'platform-multi', tag:'attack-disclosure', setvar:tx.sql_error_match=1, t:none" SecRule TX:sql_error_match "@eq 1" "msg:'Microsoft Access SQL Information Leakage', phase:response, id:951110, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-msaccess', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:JET Database Engine|Access Database Engine|\[Microsoft\]\[ODBC Microsoft Access Driver\])" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'Oracle SQL Information Leakage', phase:response, id:951120, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-oracle', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:ORA-[0-9][0-9][0-9][0-9]|java\.sql\.SQLException|Oracle error|Oracle.*Driver|Warning.*oci_.*|Warning.*ora_.*)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'DB2 SQL Information Leakage', phase:response, id:951130, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-db2', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:DB2 SQL error:|\[IBM\]\[CLI Driver\]\[DB2/6000\]|CLI Driver.*DB2|DB2 SQL error|db2_\w+\()" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'EMC SQL Information Leakage', phase:response, id:951140, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-emc', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:\[DM_QUERY_E_SYNTAX\]|has occurred in the vicinity of:)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'firebird SQL Information Leakage', phase:response, id:951150, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-firebird', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:Dynamic SQL Error)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'Frontbase SQL Information Leakage', phase:response, id:951160, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-frontbase', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:Exception (condition )?\d+\. Transaction rollback\.)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'hsqldb SQL Information Leakage', phase:response, id:951170, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-hsqldb', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:org\.hsqldb\.jdbc)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'informix SQL Information Leakage', phase:response, id:951180, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-informix', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:An illegal character has been found in the statement|com\.informix\.jdbc|Exception.*Informix)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'ingres SQL Information Leakage', phase:response, id:951190, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-ingres', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:Warning.*ingres_|Ingres SQLSTATE|Ingres\W.*Driver)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'interbase SQL Information Leakage', phase:response, id:951200, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-interbase', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:Warning: ibase_|Unexpected end of command in statement)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'maxDB SQL Information Leakage', phase:response, id:951210, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-maxdb', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:SQL error.*POS([0-9]+).*|Warning.*maxdb.*)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'mssql SQL Information Leakage', phase:response, id:951220, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-mssql', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:System\.Data\.OleDb\.OleDbException|\[Microsoft\]\[ODBC SQL Server Driver\]|\[Macromedia\]\[SQLServer JDBC Driver\]|\[SqlException|System\.Data\.SqlClient\.SqlException|Unclosed quotation mark after the character string|'80040e14'|mssql_query\(\)|Microsoft OLE DB Provider for ODBC Drivers|Microsoft OLE DB Provider for SQL Server|Incorrect syntax near|Sintaxis incorrecta cerca de|Syntax error in string in query expression|Procedure or function .* expects parameter|Unclosed quotation mark before the character string|Syntax error .* in query expression|Data type mismatch in criteria expression\.|ADODB\.Field \(0x800A0BCD\)|the used select statements have different number of columns|OLE DB.*SQL Server|Warning.*mssql_.*|Driver.*SQL[\-\_\ ]*Server|SQL Server.*Driver|SQL Server.*[0-9a-fA-F]{8}|Exception.*\WSystem\.Data\.SqlClient\.)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'mysql SQL Information Leakage', phase:response, id:951230, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-mysql', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:supplied argument is not a valid MySQL|Column count doesn't match value count at row|mysql_fetch_array\(\)|on MySQL result index|You have an error in your SQL syntax;|You have an error in your SQL syntax near|MySQL server version for the right syntax to use|\[MySQL\]\[ODBC|Column count doesn't match|Table '[^']+' doesn't exist|SQL syntax.*MySQL|Warning.*mysql_.*|valid MySQL result|MySqlClient\.)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'postgres SQL Information Leakage', phase:response, id:951240, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-pgsql', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:PostgreSQL query failed:|pg_query\(\) \[:|pg_exec\(\) \[:|PostgreSQL.*ERROR|Warning.*pg_.*|valid PostgreSQL result|Npgsql\.|PG::([a-zA-Z]*)Error|Supplied argument is not a valid PostgreSQL (?:.*?) resource|Unable to connect to PostgreSQL server)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'sqlite SQL Information Leakage', phase:response, id:951250, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-sqlite', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:Warning.*sqlite_.*|Warning.*SQLite3::|SQLite/JDBCDriver|SQLite\.Exception|System\.Data\.SQLite\.SQLiteException)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:sql_error_match "@eq 1" "msg:'Sybase SQL Information Leakage', phase:response, id:951260, rev:'1', ver:'OWASP_CRS/3.0.0', maturity:'7', accuracy:'9', t:none, capture, ctl:auditLogParts=+E, block, tag:'application-multi', tag:'language-multi', tag:'platform-sybase', tag:'attack-disclosure', tag:'OWASP_CRS/LEAKAGE/ERRORS_SQL', tag:'CWE-209', logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}', severity:'CRITICAL', chain" SecRule RESPONSE_BODY "@rx (?i)(?:Sybase message:|Warning.*sybase.*|Sybase.*Server message.*)" "capture, setvar:'tx.msg=%{rule.msg}', setvar:tx.outbound_anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.sql_injection_score=+%{tx.critical_anomaly_score}, setvar:tx.anomaly_score=+%{tx.critical_anomaly_score}, setvar:tx.%{rule.id}-OWASP_CRS/LEAKAGE/ERRORS-%{matched_var_name}=%{tx.0}" SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:3,id:951013,nolog,pass,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL" SecRule TX:PARANOIA_LEVEL "@lt 2" "phase:4,id:951014,nolog,pass,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL" # # -= Paranoia Level 2 =- (apply only when tx.paranoia_level is sufficiently high: 2 or higher) # SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:3,id:951015,nolog,pass,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL" SecRule TX:PARANOIA_LEVEL "@lt 3" "phase:4,id:951016,nolog,pass,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL" # # -= Paranoia Level 3 =- (apply only when tx.paranoia_level is sufficiently high: 3 or higher) # SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:3,id:951017,nolog,pass,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL" SecRule TX:PARANOIA_LEVEL "@lt 4" "phase:4,id:951018,nolog,pass,skipAfter:END-RESPONSE-951-DATA-LEAKAGES-SQL" # # -= Paranoia Level 4 =- (apply only when tx.paranoia_level is sufficiently high: 4 or higher) # # # -= Paranoia Levels Finished =- # SecMarker "END-RESPONSE-951-DATA-LEAKAGES-SQL"