Multiple ModSecurity Vulnerabilities Let Attackers Bypass WAF Rules and Execute Malicious Requests
ModSecurity flaws let attackers bypass WAF filename, transformation, and response-body checks.
OWASP ModSecurity disclosed multiple vulnerabilities in the version 3 engine, libmodsecurity3, and parts of the version 2 branch. High-severity issues include an RFC 2231 filename* multipart inspection bypass, an XML body-processor uninitialized pointer dereference, and a response-body inspection bypass caused by MIME-type case handling. Moderate flaws affect Base64 padding, comment removal, and PCRE2 match limits that can fail open. Several issues are tracked only by GitHub advisories because CVE identifiers are not yet assigned; fixes are versions 3.0.17 and 2.9.15.
- High-severity issues bypass upload filename and response-body inspection.
- Malformed Base64 and adjacent comments can evade rule transformations.
- PCRE2 match-limit errors can be treated as a clean no-match.
- Fixes are ModSecurity 3.0.17 and 2.9.15; several CVEs remain unassigned.
- Vendors
- OWASP
- Products
- ModSecuritylibmodsecurity3
- Organizations
- OWASP
From the original article
2 min read at gbhackers.com
OWASP ModSecurity has disclosed multiple vulnerabilities that could let attackers bypass web application firewall rules, evade request and response inspection, or trigger denial-of-service conditions. Not all of the newly published advisories currently have CVE identifiers; the project has indicated that CVE requests have been submitted via GitHub but remain unassigned for several issues. The recently […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.