JSON-Based SQL Injection - Slow regex

[christiantreutler-avi]

Describe the bug

In https://github.com/coreruleset/coreruleset/pull/3055 a new rule was introduced for JSON-Based SQL Injection. This is a v4 rule.

In testing, we have discovered that the regular expression for this rule triggers time-outs in the regex engine.

Reviewing the regex it definitively has too many backtrack points and therefore a bad worst-case behavior.

Steps to reproduce

I cannot share the actual payloads, but in our testing, it only needs a long-running relatively small JSON to trigger long running regex execution.

Additional context

Your Environment

• CRS version (e.g., v3.2.0): Custom CRS version with JSON-Based SQL Injection included.
• Paranoia level setting: PL1
• ModSecurity version (e.g., 2.9.3): VMware (Avi Load Balancer), libmodsecurity3, PCRE

[christiantreutler-avi]

@theMiddleBlue Please reach out if you like to discuss details.

[theMiddleBlue]

Thank you, @christiantreutler-avi

I'm currently reviewing the issue. @airween has already provided the payload, and I'm committed to finding a solution.

[dune73]

Any update here?

Also, is this something that has to go into CRSv4?

[christiantreutler-avi]

@dune73 Probably can be omitted until either the regex is improved or re-written.

[dune73]

Thank you. We'll just keep it open then.

[fzipi]

I'll take a look at this one now.