ModSecurity Vulnerabilities Let Attackers Bypass Web Application Firewall Protections
New ModSecurity flaws let attackers bypass WAF rules via parsing mismatches, bad Base64 handling, and comment obfuscation.
Newly disclosed OWASP ModSecurity flaws can let attackers bypass web application firewall checks through parsing differences, malformed input, transformation errors, and resource limits. High-severity issue GHSA-5pww-8rfg-9crf involves RFC 2231 filename parameters in multipart uploads that backends may accept while ModSecurity skips filename rules. Moderate issue GHSA-4j47-8qcr-jf59 can drop decoded output on bad Base64 padding, and GHSA-qrch-pjfr-9g47 can fail to strip adjacent comments used to split malicious keywords. Other advisories cover a response-body inspection bypass, XML processor flaws, multipart parsing weaknesses, and PCRE2 match-limit errors treated as no match. No in-the-wild exploitation is reported.
- High-severity GHSA-5pww-8rfg-9crf lets RFC 2231 filenames evade multipart checks.
- Malformed Base64 padding can discard decoded output and hide payloads.
- Comment removal may miss adjacent comments used to split malicious keywords.
- Other flaws include response-body bypass, XML parsing, and PCRE2 match limits.
- Administrators should patch ModSecurity and test obfuscated payloads.
- Vendors
- OWASP
- Products
- ModSecurity
- Organizations
- OWASP
From the original article
2 min read at cybersecuritynews.com
Multiple newly disclosed vulnerabilities in OWASP ModSecurity could let attackers bypass web application firewall protections by exploiting parsing differences, malformed input, transformation errors, and resource limits. The flaws affect functions commonly used to inspect HTTP requests and responses, raising concerns for organizations that rely on ModSecurity rules to detect malicious payloads. One of the most […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.