nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

WAF Blocking JQL Queries as SQL INJECTION

Nikhil_6vjf9m

We have spoke to our WAF vendor and they came with the following issues. were WAF is blocking the traffic as it assumes JQL as SQL. Is there any way we could do the changes in APPLICATION LEVEL. For Eg:- Users "A" when accessing externally filtering an issue using JQL filter. JIRA is unable to load the issues. When checked WAF logs method say PUT and Attack say SQL INJECTION. Is there any way we can over come this issue. Thankyou

Accepted answers

All comments

Grigory Salnikov_0hffsd

Hi @Nikhil !

I think you could approach this issue from 2 sides:

1. Whitelist known IP addresses (for example your HQ's or branches');

2. Tune WAF so that it accepts frequent JQL expressions, especially those used in public filters.

Seth_ifyb7w

I'm not sure what WAF is being used, but we used an AWS WAF that would flag a request as SQL injection just for having " and " or " or " in the string. There is a lot of syntax in common between JQL and SQL, so whitelisting the known IP addresses or specific pages that accept JQL is going to be your best bet.

To be fair, the AWS WAF rules didn't allow for much tuning (that I'm aware of), but your WAF may.

Grigory Salnikov_0hffsd

False-positives are an essential part of every WAF, so you're to spend some time fine-tuning it. WAFs are not to be considered as some kind of safety-switch

Nikhil_6vjf9m

@Seth whitelisting web pages is not a good option as it my be same as just disableing SQL Injection. Thank you

Nikhil_6vjf9m

@Seth I am sorry I didn't get you. Can you explain wether this can be done or not in WAF. By the way is there a way we can set WAF to accept JQL but still not accept WAF. I guess I am asking which is not possible. Anyways thank you guys.

Nic Brough -Adaptavist-

The problem here is your WAF settings, and you're asking people who know Atlassian stuff, not WAF (and you've not even said what WAF).

You need to configure the WAF to allow this through, there's nothing that can be done on the application side, as it's not doing anything wrong.

It certainly is possible, if you're using the right sort of WAF. The response from your vendor (try to blame someone else) suggests that it doesn't support doing it properly, so you're probably stuck.

Nikhil_6vjf9m

Yeah true we are using fortinet. And I was just checking other way how can we make this application secure. Thank you

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

sql

jira

jql

firewall

security