WAF Bypass Vulnerability Affects ModSecurity v3
CVE-2024-1019

8.6HIGH

Key Information:

Vendor

Owasp Modsecurity

Status
Modsecurity
Vendor
CVE Published:
30 January 2024

What is CVE-2024-1019?

ModSecurity versions 3.0.0 through 3.0.11 are susceptible to a WAF bypass vulnerability, wherein attackers can craft request URLs that exploit the way ModSecurity handles percent-encoded characters. The improper decoding and separation of the URL path component from the query string can lead to discrepancies with RFC-compliant back-end applications. This flaw allows an attack payload to be concealed within the path component of the URL, potentially evading WAF inspection rules. Organizations utilizing ModSecurity are encouraged to upgrade to version 3.0.12 to mitigate this issue.

Affected Version(s)

ModSecurity 3.0.0 <= 3.0.11

References

https://owasp.org/www-project-modsecurity/tab_cves#cve-20...
https://lists.fedoraproject.org/archives/list/package-ann...
https://lists.fedoraproject.org/archives/list/package-ann...

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrea Menin @AndreaTheMiddle <https://github.com/theMiddleBlue>
Matteo Pace @M4tteoP <https://github.com/M4tteoP>
Max Leske <https://github.com/theseion>
Ervin HegedĂĽs @airween <https://github.com/airween>
.