SQLinjection not being detected by PA

[SOC_CSG]

Hi, we are receiving these tries about SQL injection but our Palo alto is not detecting it. How can we do that PA detect this SQLi????? we have updated the threats signatures.

Sql injection

GET /ficha-modelo?id=2&entidad=99999999%27%20oR%20%277%27=%277 HTTP/1.1" 500 59878 "-" "Mozilla/4.0

GET /ficha-modelo?entidad=!S!WCRTESTINPUT000000%3C%3E%3c%3e%253c%253e!E!&id=2 HTTP/1.1" 500 59878 "-" "Mozilla/4.0"

[pankaku]

Have you applied proper security profiles to the concern security policies?

[SOC_CSG]

Yes its matching the correct policy.

[pankaku]

No I am talking about the antivirus, antispyware, vulnerabiltiy profile are applied to the security rules?

[SOC_CSG]

we have the 3 security profiles assigned in the default config for this connection. What can we do in order to detect this SQLi??? 

[cpainchaud]

typicall something that should be caught by a WAF/ReverseProxy that is fine tuned for specific customer needs, not a firewall or a IPS in my opinion.

[pankaku]

You have to create security profile and apply them into the security rules

Objectes> Security profiles> Antivirus> clone default one and modify it accordingly.

Objectes> Security profiles> Anti-Spyware> clone default one and modify it accordingly.

Objectes> Security profiles> Vulnerability Profile> clone default one and modify it accordingly.

The default profiles are okay but you cannot modify them that'w why we need to clone them.

Now go to the Policies> Security> Open the security policy which is allowing the traffic and into that go to action call the above new profiles

[SOC_CSG]

Yes i know but PA doesnt have the specific siganture for this SQLi. We have everything enabled and its not being detected.

[Lucky]

Hi, COS,

SQLi will be the best effort, it will catch the most common attempts and will not evaluate any string for SQLi. If you really need that, create your own custom threat signature to improve posture, or consider offloading such job to a dedicated web / app firewall.

Great read on creating custom threat signatures can be found in this tech note: https://live.paloaltonetworks.com/t5/Articles/Creating-Custom-Threat-Signatures/ta-p/58569

Regards

Luciano