Web Application Firewall (NGINX ModSecurity) - wrong SQL Injection Attack Detection

Question

Our company site is behind WAF based on NGINX ModSecurity. And permanently in WAF logs we see blocked requests from site forms. Example:

SQL Injection Attack Detected via libinjection - Matched Data: sos found within ARGS:BoxOrgName: %u041e%u041e%u041e "%u0422%u0440%u0438%u043e+"

Why it happens? This string:

%u041e%u041e%u041e "%u0422%u0440%u0438%u043e+"

is just Cyrillic company name:

ООО "Трио+"

How and what can we configure in mod_security to prevent such wrong request blocking?

airween · Accepted Answer · 2025-07-07 08:00:46Z

0

This is a so-called "false positive" (FP).

First, you should set your Nginx error log with info severity, like this:

error_log /path/to/error.log info;

Then you can check this log for results - there you can see the triggered rule, its message and data, and some other useful information. Beside of these, there is the uri - with these information, you can create a so-called exclusion. An exclusion helps to trigger FP.

You can read about handling FP's here.

answered Jul 7 at 8:00

airween

6,3231 gold badge16 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Web Application Firewall (NGINX ModSecurity) - wrong SQL Injection Attack Detection

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related