CVE-2022-39958
Response body bypass in OWASP ModSecurity Core Rule Set via repeated HTTP Range header submission with a small byte range
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass to sequentially exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range. A restricted resource, access to which would ordinarily be detected, may be exfiltrated from the backend, despite being protected by a web application firewall that uses CRS. Short subsections of a restricted resource may bypass pattern matching techniques and allow undetected access. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively and to configure a CRS paranoia level of 3 or higher.
OWASP ModSecurity Core Rule Set (CRS) esta afectado por una omisión del cuerpo de respuesta para exfiltrar secuencialmente secciones pequeñas e indetectables de datos mediante el envío repetido de un campo de encabezado HTTP Range con un pequeño rango de bytes. Un recurso restringido, cuyo acceso sería normalmente detectado, puede ser exfiltrado desde el backend, a pesar de estar protegido por un firewall de aplicaciones web que usa CRS. Las subsecciones cortas de un recurso restringido pueden omitir las técnicas de comparación de patrones y permitir un acceso no detectado. Las versiones heredadas de CRS 3.0.x y 3.1.x están afectadas, así como las versiones 3.2.1 y 3.3.2 actualmente soportadas. Es recomendado a integradores y usuarios actualizar a versiones 3.2.2 y 3.3.3 respectivamente y que configuren un nivel de paranoia de CRS de 3 o superior
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-09-05 CVE Reserved
- 2022-09-20 CVE Published
- 2024-04-12 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-116: Improper Encoding or Escaping of Output
- CWE-863: Incorrect Authorization
CAPEC
References (6)
URL | Tag | Source |
---|---|---|
https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html | Mailing List |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves | 2023-11-07 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Owasp Search vendor "Owasp" | Owasp Modsecurity Core Rule Set Search vendor "Owasp" for product "Owasp Modsecurity Core Rule Set" | >= 3.0.0 < 3.2.2 Search vendor "Owasp" for product "Owasp Modsecurity Core Rule Set" and version " >= 3.0.0 < 3.2.2" | - |
Affected
| ||||||
Owasp Search vendor "Owasp" | Owasp Modsecurity Core Rule Set Search vendor "Owasp" for product "Owasp Modsecurity Core Rule Set" | >= 3.3.0 < 3.3.3 Search vendor "Owasp" for product "Owasp Modsecurity Core Rule Set" and version " >= 3.3.0 < 3.3.3" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 36 Search vendor "Fedoraproject" for product "Fedora" and version "36" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 37 Search vendor "Fedoraproject" for product "Fedora" and version "37" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
|