GoQR.me QR Code Reader misbehaving

[mattem]

I have an XSOAR 8.5 instance with a playbook which makes use of the GoQR.me QR Code Reader integration.

It had been working nicely in the playbook for months, but has begun to misbehave.

In the playbook, images are extracted from a phishing email and stored in XSOAR, and the IDs of the images are fed through

!goqr-read-qr-code-from-file entry_id= with either a single value (rarely) or in most cases an array of EntryIDs as "Entry_ID= [/"first_id",/"second_id"....]

This had been working for a few months, but starting late last week it began to return errors as follows, after 120 seconds:

Reason

Error from QR Code Reader - goqr.me is : Script failed to run: Error: [Traceback (most recent call last): File "<string>", line 76, in <module> File "<string>", line 63, in main File "<string>", line 21, in read_qr_code File "<string>", line 93, in getFilePath File "<string>", line 289, in __do ValueError: timeout while waiting for answer: request 968af3ca-046f-48c3-82df-4e3a10613969. Wait time:2m0s (1515) ] (2604) (2603)

If I run !goqr-read-qr-code-from-file with a single EntryID, I get a sensible response.

If I submit two IDs, I get the script error above.

Is anyone else having this issue, and can anyone shed any light on what's going wrong?

[mattem]

I have an update on this.

After reconfiguring the integration to run on an engine, and setting up tcpdump to monitor all connections to the four publicly listed IP addresses of api.qrserver.com, I can see traffic between the engine and the API server if I submit a single Entry_ID

If I submit more than one Entry_ID, the engine server doesn't even try to connect to the API server.

So something in the Integration has broken such that it does not attempt to contact the API server in the event that more than one Entry_ID is supplied. But this worked perfectly earlier in the year.

[oromeromoya]

Hi @Mattern

Thanks for reaching out to us about this topic. Can you please answer the following questions?

- Have you recently applied an update/fix to your XSOAR environment?

- Which is the current version of XSOAR and GoQR.me QR Code Reader integration? (can you please refer us to the version/scenario where the integration ran as expected?)

- If you submit more than one Entry_ID and it stops working as expected, it is probable that the automation code will require some update to process other IDs again. As a workaround (if any update was installed for the integration), you should try rolling back to the version that was working previously.