TCP Packet Manipulation in Suricata Firewall by Open Information Security Foundation
CVE-2021-45098
7.5HIGH
What is CVE-2021-45098?
A vulnerability has been discovered in Suricata, a high-performance network IDS, IPS, and NSM engine, which affects versions prior to 6.0.4. This issue allows attackers to bypass HTTP-based signatures by exploiting the TCP protocol through manipulation of RST packets. Specifically, an attacker can forge an RST TCP packet with random TCP options from the client side following the three-way handshake, and subsequently send an HTTP GET request to a forbidden URL. As a result, the vulnerable server does not recognize the injected RST ACK, leading to the unauthorized processing of requests that would otherwise be blocked, compromising the integrity of the security measures in place.
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved