coreruleset · fzipi · Sep 9, 2025 · Jul 8, 2024 · Jul 22, 2024 · Mar 26, 2025
diff --git a/regex-assembly/942550.ra b/regex-assembly/942550.ra
@@ -3,28 +3,42 @@
 
 ##! Referring to https://claroty.com/team82/research/js-on-security-off-abusing-json-based-sql-to-bypass-waf
 ##! this rule tries to match the following payloads:
-##! 
+##!
+##! PostgreSQL reference: https://www.postgresql.org/docs/current/functions-json.html
 ##! PostgreSQL: '{"b":2}'::jsonb <@ '{"a":1, "b":2}'::jsonb
 ##! PostgreSQL: '{"b":2}'::jsonb @> '{"a":1, "b":2}'::jsonb
 ##! PostgreSQL: '{"b":2}'::jsonb @ '{"a":1, "b":2}'::jsonb
 ##! PostgreSQL: '{"b":2}'::jsonb < '{"a":1, "b":2}'::jsonb
 ##! PostgreSQL: '{"b":2}'::jsonb > '{"a":1, "b":2}'::jsonb
+
+##! SQLite reference: https://www.sqlite.org/json1.html
 ##! SQLite: '{"a":2,"c":[4,5,{"f":7}]}' -> '$.c[2].f' = 7
 ##! SQLite: '{"a":2,"c":[4,5,{"f":7}]}' <- '$.c[2].f' = 7
 ##! SQLite: '{"a":2,"c":[4,5,{"f":7}]}' < '$.c[2].f' = 7
 ##! SQLite: '{"a":2,"c":[4,5,{"f":7}]}' > '$.c[2].f' = 7
+
+##! MySQL reference: https://dev.mysql.com/doc/refman/8.4/en/json-function-reference.html
 ##! MySQL: JSON_EXTRACT('{"id": 14, "name": "Aztalan"}', '$.name') = 'Aztalan'
+##! MySQL: SELECT id FROM users WHERE id=JsoN_EXTraCT/**/(/**/'  {"a":1}  '/**/,/**/' $.a '/**/);
+
+##! This regex relies on the `removeWhitespace` transformation.
+
+##!+ i
 
 ##!> define quotes [\"'`]
 ##!> define operators (?:@>|<@|\?|\?\||\?&|#>|#>>|->>|<|>|->|<-)
-##!> define json_ending_brackets [\]\}]
-##!> define json_starting_brackets [\[\{]
+##!> define json_starting_brackets [[{]
+##!> define something_except_json_ending_brackets [^}\]#]*
+##!> define json_ending_brackets [\]}]+
+##!> define sql_comment (/\*.*?\*/)?
+##!> define non_greedy_jsonb (?:::{{sql_comment}}jsonb?)?
 
 ##!> assemble
-  ##! https://regex101.com/r/mzG5Fg/1
-  {{quotes}}{{json_starting_brackets}}.*{{json_ending_brackets}}{{quotes}}.*(::.*jsonb?)?.*{{operators}}
-  {{operators}}{{quotes}}{{json_starting_brackets}}.*{{json_ending_brackets}}{{quotes}}
+  ##! SQLite + PostgreSQL
+  {{non_greedy_jsonb}}{{operators}}
+  {{quotes}}{{json_starting_brackets}}{{something_except_json_ending_brackets}}{{json_ending_brackets}}{{quotes}}
+  {{operators}}{{quotes}}{{json_starting_brackets}}{{something_except_json_ending_brackets}}{{json_ending_brackets}}{{quotes}}
 
-  ##! example: SELECT id FROM users WHERE id=JsoN_EXTraCT/**/(/**/'  {"a":1}  '/**/,/**/' $.a '/**/);
-  json_extract.*\(.*\)
+  ##! MySQL
+  \bjson_extract\b[^\(]*\([^)]*\)
 ##!<
diff --git a/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf b/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
@@ -605,11 +605,11 @@ SecRule REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)1\
 # (consult https://coreruleset.org/docs/development/regex_assembly/ for details):
 #   crs-toolchain regex update 942550
 #
-SecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx [\"'`][\[\{].*[\]\}][\"'`].*(::.*jsonb?)?.*(?:(?:@|->?)>|<@|\?[&\|]?|#>>?|[<>]|<-)|(?:(?:@|->?)>|<@|\?[&\|]?|#>>?|[<>]|<-)[\"'`][\[\{].*[\]\}][\"'`]|json_extract.*\(.*\)" \
+SecRule REQUEST_FILENAME|REQUEST_COOKIES|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@rx (?i)(?:::(/\*.*?\*/)?jsonb?)?(?:(?:@|->?)>|<@|\?[&\|]?|#>>?|[<>]|<-)|(?:(?:@|->?)>|<@|\?[&\|]?|#>>?|[<>]|<-)?[\"'`][\[\{][^#\]\}]*[\]\}]+[\"'`]|\bjson_extract\b[^\(]*\([^\)]*\)" \
     "id:942550,\
     phase:2,\
     block,\
-    t:none,t:urlDecodeUni,t:lowercase,t:removeWhitespace,\
+    t:none,t:urlDecodeUni,t:removeWhitespace,\
     msg:'JSON-Based SQL Injection',\
     logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
     tag:'application-multi',\

diff --git a/tests/regression/tests/REQUEST-942-APPLICATION-ATTACK-SQLI/942550.yaml b/tests/regression/tests/REQUEST-942-APPLICATION-ATTACK-SQLI/942550.yaml
@@ -670,3 +670,21 @@ tests:
         output:
           log:
             expect_ids: [942550]
+  - test_id: 37
+    desc: |
+      SQL Comment in payload
+      decoded payload: OR '{"a":1}'::jsonb #> /* Some * comment */'{a,b}' ? 'c'
+    stages:
+      - input:
+          dest_addr: 127.0.0.1
+          headers:
+            Host: localhost
+            User-Agent: "OWASP CRS test agent"
+            Accept: "*/*"
+          method: GET
+          port: 80
+          uri: "/get?q=OR%20%27%7B%22a%22%3A1%7D%27%3A%3Ajsonb%20%23%3E%20%2F%2A%20Some%20%2A%20comment%20%2A%2F%27%7Ba%2Cb%7D%27%20%3F%20%27c%27"
+          version: HTTP/1.1
+        output:
+          log:
+            expect_ids: [942550]