OWASP ModSecurity Core Rule Set up to 3.0.x/3.1.x/3.2.1/3.3.2 HTTP Multipart Request Content-Type/Content-Transfer-Encoding authorization

Summaryinfo

A vulnerability classified as critical was found in OWASP ModSecurity Core Rule Set up to 3.0.x/3.1.x/3.2.1/3.3.2. Affected by this vulnerability is an unknown functionality of the component HTTP Multipart Request Handler. Such manipulation of the argument Content-Type/Content-Transfer-Encoding leads to authorization. This vulnerability is uniquely identified as CVE-2022-39956. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in OWASP ModSecurity Core Rule Set up to 3.0.x/3.1.x/3.2.1/3.3.2. It has been rated as critical. Affected by this issue is an unknown function of the component HTTP Multipart Request Handler. The manipulation of the argument Content-Type/Content-Transfer-Encoding with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and inspected by the web application firewall engine and the rule set. The multipart payload will therefore bypass detection. A vulnerable backend that supports these encoding schemes can potentially be exploited. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised upgrade to 3.2.2 and 3.3.3 respectively. The mitigation against these vulnerabilities depends on the installation of the latest ModSecurity version (v2.9.6 / v3.0.8).

The weakness was disclosed 09/20/2022. The advisory is shared for download at coreruleset.org. This vulnerability is handled as CVE-2022-39956 since 09/05/2022. There are known technical details, but no exploit is available.

Upgrading to version 3.2.2 or 3.3.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• OWASP

Name

• ModSecurity Core Rule Set

Version

• 3.0
• 3.1
• 3.2.0
• 3.2.1
• 3.3.0
• 3.3.1
• 3.3.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion