Critical Vulnerability in ModSecurity-Apache: HTTP Multipart Request Parsing Flaw
Summary
UBUNTU-CVE-2022-48279: In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. Affects modsecurity-apache versions < 2.7.7-2ubuntu0.1~esm1. Fixed in 2.7.7-2ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ModSecurity is an open-source web application firewall (WAF) that provides protection against various web-based attacks. It is widely used in conjunction with the Apache web server to enhance security by filtering and monitoring HTTP traffic. The impacted package, modsecurity-apache, is specifically designed to integrate ModSecurity with Apache, allowing users to implement security rules and policies effectively. However, recent vulnerabilities have raised concerns about its ability to handle HTTP multipart requests securely.
Vulnerability Detail
In ModSecurity versions prior to 2.9.6 and 3.x before 3.0.8, a flaw exists in the parsing of HTTP multipart requests. This vulnerability can lead to the bypassing of the Web Application Firewall, potentially allowing malicious actors to exploit web applications by sending crafted multipart requests. The issue is related to CVE-2022-39956, but it represents independent changes within the ModSecurity codebase. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.7.7-2ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement stricter input validation rules within their web applications to mitigate the risk of exploitation until the package is updated. Additionally, disabling multipart request handling in ModSecurity may reduce exposure to this vulnerability, but it could impact legitimate functionality.
Conclusion
The vulnerability in ModSecurity's handling of HTTP multipart requests poses a significant risk to web applications. It is crucial for users to update their modsecurity-apache package to the latest patched version to mitigate this risk. Implementing additional security measures and using tools like Vulert can further enhance your application's security posture.
See every vulnerability recorded for modsecurity-apache →
FAQ
ModSecurity is an open-source web application firewall that helps protect web applications by filtering and monitoring HTTP traffic.
This vulnerability affects the modsecurity-apache package, which integrates ModSecurity with the Apache web server.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Regularly check for updates from your package manager and consider using tools like Vulert to monitor vulnerabilities in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
