Security on CRS Project

CVE-2023-38199 – Multiple Content-Type Headers

Mon, 17 Jul 2023 10:57:39 +0200

The OWASP ModSecurity Core Rule Set (CRS) v3.3.4 does not detect the presence of multiple HTTP “Content-Type” header fields. As a result, on some platforms, it is possible to cause a CRS installation to process an HTTP request body differently (because of the different Content-Type) to how it would be processed by a backend web application.

See the advisory at https://nvd.nist.gov/vuln/detail/CVE-2023-38199.

Update: CRS version 3.3.5 has now been released to address this vulnerability.

Disabling Request Body Access in ModSecurity 3 Leads to Complete Bypass

Tue, 02 Mar 2021 12:22:10 +0100

If you are running ModSecurity 3 with request body access disabled, then I have some bad news. Please sit down, this will be a while. If you are running ModSecurity 2, or you give the engine access to the request body, then you are not affected. But maybe you want to read this post nevertheless. I’ll be discussing a new ModSec3 vulnerability an upcoming new CRS feature and some fundamental problems affecting existing ModSecurity rule sets.

CVE-2019-19886 - HIGH - DoS against libModSecurity 3

Sat, 18 Jan 2020 08:32:00 +0100

The ModSecurity 3.0.x release line suffers from a Denial of Service vulnerability after triggering a segmentation fault on the webserver when parsing a malformed cookie header.

All users of ModSecurity 3.0.0 - 3.0.3 should update to ModSecurity 3.0.4 as soon as possible.

ModSecurity 2.x is not affected.

The CVSS score for the vulnerability is 7.5 (HIGH). MITRE lists the vulnerability as CVE-2019-19886 (but as of this writing, it is only reserved).

The OWASP ModSecurity Core Rule Set (CRS) project makes heavy use of unit tests. One of the goals is making sure that all our rules behave as intended on the underlying ModSecurity engine. ModSecurity 2.9 on Apache is our reference platform that passes our expanding list of over 2300 tests.

Regular Expression DoS weaknesses in CRS

Thu, 25 Apr 2019 15:29:15 +0200

Somdev Sangwan has discovered several Regular Expression Denial of Service (ReDoS) weaknesses in the rules provided by the CRS project. They are listed under the following CVEs:

The fact that CRS is affected by ReDoS is not particularly surprising and truth be told, we knew that was the case. We just have not solved it yet - or have not been able to solve it yet.