A vulnerability was found in ModSecurity 3.0.0/3.0.1/3.0.2/3.0.3/3.0.4. It has been rated as problematic. This issue affects some unknown processing. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability.

The weakness was disclosed 09/14/2020 by Ervin Hegedüs as confirmed mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The public release has been coordinated in cooperation with the project team. The identification of this vulnerability is CVE-2020-15598. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a private exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue. The following code is the reason for this vulnerability:

do { rc = pcre_exec(m_pc, …) … } while (rc > 0)

A private exploit has been developed by Ervin Hegedüs. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 91 days. During that time the estimated underground price was around $0-$5k. The real existence of this vulnerability is still doubted at the moment.

Applying the patch cve-2020-15598.patch is able to eliminate this problem. The bugfix is ready for download at gist.githubusercontent.com. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Productinfo

Name

• ModSecurity

Version

• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion