Content-Type Confusion Vulnerability in modsecurity-crs: Bypass Risk for Web Application Firewalls
Summary
DEBIAN-CVE-2023-38199: coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. Affects modsecurity-crs versions < 3.3.5-1. Fixed in 3.3.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
modsecurity-crs, also known as the OWASP ModSecurity Core Rule Set, is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls (WAFs). It is designed to protect web applications from various types of attacks by analyzing incoming requests and responses. However, versions up to 3.3.4 are vulnerable to a specific issue where multiple Content-Type request headers may not be detected correctly, potentially allowing attackers to bypass the WAF.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2023-38199 arises from the inability of modsecurity-crs versions up to 3.3.4 to detect multiple Content-Type request headers on certain platforms. This flaw can lead to a situation known as 'Content-Type confusion', where the WAF and the backend application may interpret the headers differently. Attackers can exploit this by crafting payloads that manipulate the Content-Type headers, potentially bypassing security measures and compromising the web application. The issue is particularly concerning as it relies on the web application only recognizing the last Content-Type header, while other platforms may reject or merge conflicting headers, resulting in malformed header detection.
How To Fix
Minimum fixed version
3.3.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-crsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing additional validation on the server-side to handle Content-Type headers more securely. This could involve rejecting requests with multiple Content-Type headers or ensuring that your application processes headers in a way that mitigates the risk of confusion.
Conclusion
The Content-Type confusion vulnerability in modsecurity-crs poses a significant risk to web applications by allowing potential bypass of security measures. It is crucial to update to the latest version to safeguard against this issue. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for modsecurity-crs →
FAQ
The vulnerability can allow attackers to bypass web application firewalls, potentially leading to unauthorized access or exploitation of the web application.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of modsecurity-crs up to 3.3.4 are affected by this vulnerability.
Yes, the patched version is 3.3.5-1. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, consider implementing server-side validation to mitigate the risk associated with multiple Content-Type headers.
References
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-crs.
