XF 2.2 SQL Injection Warnings

[Bonsai Coder]

Some of my users report that when posting a long response (or taking a long time to type a response) they will sometimes get locked out of the site for an hour... after which they are allowed to return and everything runs as normal.

Looking into my server, I have ModSecurity enabled, and see a lot of "Rule 300016: Generic SQL injection protection" hits.

Here is an example:

Request: POST /threads/satsuki-repot.45070/draft

Action Description: Access denied with code 500 (phase 2).

Justification: Pattern match "(insert[[:space:]]+into.+values|select.*from.+[a-z|A-Z|0-9]|select.+from|bulk[[:space:]]+insert|union.+select|convert.+\\(.*from)" at ARGS:message_html.

The same hits are being triggered several times by the same user trying to "post" or "edit" the same content:

Request: POST /threads/satsuki-repot.45070/add-reply

Action Description: Access denied with code 500 (phase 2).

Justification: Pattern match "(insert[[:space:]]+into.+values|select.*from.+[a-z|A-Z|0-9]|select.+from|bulk[[:space:]]+insert|union.+select|convert.+\\(.*from)" at ARGS:message_html.

Now I can just disable ModSecurity... but I'd like to try to understand these SQL injection warnings. Are they false positives? Or is there a real security risk?

 

[Kirby]

Hmm ... message_html ist der field for the editor content, eg. the post/message itself.
Would be quite interesting to know the full string the was submitted.

 

[Chris D]

Yes would be interesting to see more. message_html in its raw format doesn’t go anywhere near the database as it is rendered to BB code before writing so very likely to be a false positive though I wonder if they are at least trying for potential vectors that way.

Alternatively someone could just be trying to post a SQL code snippet. Does that potentially match up with content someone might post on your forum @Bonsai Coder?

 

[Kirby]

Alternatively someone could just be trying to post a SQL code snippet

That's what came up my mind too, but the forum seems to be about plants - IMHO pretty unlikely that users would post SQL

 

[Bonsai Coder]

Definitely not posting SQL - just a ton of quotes and responses to posts. The only thing I can think of would be the use of "@" in the post to reference a user(?)

I wasn't able to replicate the issue until yesterday, and then it occurred when I was truly doing nothing more than responding to a post. I responded, and then went in and edited my post a couple of times, and then when I tried to repost I found myself locked out of my own site; the firewall had blocked my IP

 

[Bonsai Coder]

Ok so at the risk of reading too much gardening info, here is text that will trigger the firewall hit if sent as a complete unit via PM:

Has it really be in there for 5 years? That's a really long time, especially for a mix of that type. Keeping it in there is also a type of risk. Since it is late winter for you it is dormant.

I may have said the thing about 'i've read somewhere that some don't take to Kanuma easily when grown in the ground'. But if you mean me, then you misunderstood me. I was talking specifically about new cultivar. And that a genetic flaw that a new cultivar may have is that they don't do well under certain conditions.

Whatever you have was likely selected in Japan for doing well as a bonsai in kanuma. We can have another debate about if a plant that has exceptional vigor in kanuma in Japan will have the same exceptional vigor when in peat in Europe, NA or NZ.

This likely is going into another training pot? Hard for me to judge how much it did grow as you say you pruned it heavily and it is winter now. I think I would put it in a shallow training pot with 50-50 kanuma-ericacious mix. I feel this is a safer option. The larger the pot, the easier it is to water properly, the less important having 100% kanuma is.



I would find a shallower pot with maybe only a slightly smaller diameter. Make sure it has very good draining holes. Not just one tiny hole. Plastic nursery pots show the proper amount of drainage holes. Terracotta pots never have, unless they are bonsai pots from Japan. Put a layer or large grain kanuma in the bottom would be best, but optionl. Then mix 50-50 ericacious mix and normal size kanuma. Put a layer on top of the large drainage kanuma. Then take your azalea out of the pot it is in now and look at the roots. You think it is not pot bound? I would say that it probably isn't. So then try to wash away old soil with water. If it is pot bound, rake open the rook ball. Then place it in the new pot and make sure your roots are at the right level. You will only be adding a very shallow layer of mix on top of your roots, so that you can no longer see the roots. Not more. If you were planting a nursery azalea in your garden, you would actually keep the root ball a cm above the soil layer and then put mulch up to the top of the rootball to keep the top roots cool.

This youtube channel has many videos of azalea bonsai being repotted. Most of them are 50 years old and go back into bonsai pots. So there is a lot of root pruning to maintain or develop nebari, that you could skip.



https://www.youtube.com/channel/UC1rEamX-tmBE6ZbqDe2IVdQ



Think about how you could be harming it by repotting it? I think you said that frost risk is over. It is dormant right now. You aren't going to be taking away a lot of roots either. And if it turns out it does have a lot of roots and it does need some root ball raking. Think about how much leaves it has right now vs how much roots. And about how much water it will be needing. These are the summer leaves that it keeps during winter. These are specialized to not lose a lot of moisture in case the plant freezes solid and cannot take up any water.

As for whether to repot it nor or in two weeks, I don't know your climate. The most perfect timing would be to do it just before the roots start to grow. But if you can't hit that perfect timing, doing it a week too early is better than doing it a week after the roots started growing. Because then you maybe cutting or damaging newly grown roots. And note that roots start growing earlier than the first sign of new buds.

If this text is split into two sections, and each section is sent separately, it does not appear to trigger the security alert.

 

[Bonsai Coder]

Wow. It appears that any instance of "select" followed by "from" later in the message will trigger the warning... even in plain text.

 

[Paul B]

Well those do form SQL statements so it does seem like the mod_sec rules are being triggered erroneously.

 

[Bonsai Coder]

Just to close this thread in case someone has the same issue. It was a single firewall rule in mod_sec that was causing the false positives. When that one rule was whitelisted, the errors disappeared. Any combination of text, followed by the letters "select" followed by any combination of text, followed by the letters "from" would trigger the error. For example:

"The best selection of frommage is found in France" would trigger the firewall - and five attempts to post it would get you an IP block.

 

[Chris D]

That's quite amusing. Thanks for the update. We often don't get as much detail when an issue is triggered by mod_security or similar so to have a bit of closure on it is interesting.

 

[pcguy]

domain .com /?query=query%25%27+AND+3667%3D8756%2516




this is a sql injection vulnerability no one listens to me at all i am using xenforo 2.1
is this a known vulnerability which is fixed?

 

[Paul B]

Why do you think that?

Have you actually tried it?
What do you think it does?

 

[pcguy]

Why do you think that?

Have you actually tried it?
What do you think it does?

a pentester tried it and said anyone can download my database with it if they use this vulnerability in a different way

 

[Chris D]

There is no functionality within XenForo that would allow you to arbitrarily pass SQL into a URL, have that parsed and be executed as a MySQL query.

If this “pentester“ was legitimate they would be able to provide a proof of concept to demonstrate the issue. I highly doubt they can.

I hope this isn‘t a service you’re paying for…

 

[bzcomputers]

Just an FYI, here is a list of Mod Security Rules that I found were often falsely triggered and needed to be disabled for either XenForo or WordPress sites.

300006 - triggered when url has ".../", url would return a 500 server error, turning off rule url gives a 404 error as it should
300014 - triggered when adding new resources to download (XenForo)
300015 - triggered when adding new resources to download (XenForo)
300016 - triggered when adding new resources to download (XenForo)
332039 - blocked Google IPs from getting robots.txt file
340162 - unable to upload or save resources (XenForo)
340163 - unable to upload or save resources (XenForo)
933100 - unknown
933150 - unknown
941160 - unable to save page edits (WordPress)
949110 - unable to save page edits (WordPress)
980130 - unable to save page edits (WordPress)