// For flags

CVE-2024-1019

WAF bypass of the ModSecurity v3 release line

Severity Score

8.6
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string component. This results in an impedance mismatch versus RFC compliant back-end applications. The vulnerability hides an attack payload in the path component of the URL from WAF rules inspecting it. A back-end may be vulnerable if it uses the path component of request URLs to construct queries. Integrators and users are advised to upgrade to 3.0.12. The ModSecurity v2 release line is not affected by this vulnerability.

ModSecurity/libModSecurity 3.0.0 a 3.0.11 se ve afectado por una omisión de WAF para payloads basados en rutas enviados a través de URL de solicitud especialmente manipuladas. ModSecurity v3 decodifica los caracteres codificados en porcentaje presentes en las URL de solicitud antes de separar el componente de ruta URL del componente de cadena de consulta opcional. Esto da como resultado una discrepancia de impedancia en comparación con las aplicaciones de back-end que cumplen con RFC. La vulnerabilidad oculta un payload de ataque en el componente de ruta de la URL de las reglas WAF que la inspeccionan. Un back-end puede ser vulnerable si utiliza el componente de ruta de las URL de solicitud para construir consultas. Se recomienda a los integradores y usuarios que actualicen a 3.0.12. La línea de lanzamiento ModSecurity v2 no se ve afectada por esta vulnerabilidad.

*Credits: Andrea Menin @AndreaTheMiddle <https://github.com/theMiddleBlue>, Matteo Pace @M4tteoP <https://github.com/M4tteoP>, Max Leske <https://github.com/theseion>, Ervin Hegedüs @airween <https://github.com/airween>
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2024-01-29 CVE Reserved
  • 2024-01-30 CVE Published
  • 2024-02-20 EPSS Updated
  • 2024-08-01 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
  • CAPEC description not found.
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Trustwave
Search vendor "Trustwave"
 Modsecurity
Search vendor "Trustwave" for product "Modsecurity"
 >= 3.0.0 < 3.0.12
Search vendor "Trustwave" for product "Modsecurity" and version " >= 3.0.0 < 3.0.12"
-
Affected