Critical Vulnerabilities in ModSecurity-Apache Package: Denial of Service and Bypass Risks
Summary
USN-6370-1: modsecurity-apache vulnerabilities. Affects modsecurity-apache versions < 2.7.7-2ubuntu0.1~esm1. Fixed in 2.7.7-2ubuntu0.1~esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ModSecurity is an open-source web application firewall (WAF) that provides protection against various web-based attacks. It is widely used in conjunction with the Apache HTTP Server to enhance security by filtering and monitoring HTTP traffic. The ModSecurity-Apache package is essential for implementing security rules and policies to safeguard web applications. However, recent vulnerabilities have been identified that could compromise its effectiveness and expose systems to attacks.
Vulnerability Detail
The vulnerabilities discovered in the ModSecurity-Apache package include improper handling of nested JSON objects, HTTP multipart requests, and file uploads. Specifically, CVE-2021-42717 allows attackers to exploit nested JSON objects, potentially leading to a denial of service. CVE-2022-48279 enables remote attackers to bypass ModSecurity restrictions through malformed HTTP requests. Additionally, CVE-2023-24021 presents a risk of buffer overflow and firewall failure due to mishandled file uploads. These vulnerabilities primarily affect Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, and 22.04 LTS.
How To Fix
Minimum fixed version
2.7.7-2ubuntu0.1~esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling ModSecurity for specific requests or endpoints that are known to trigger the vulnerabilities. This can be done by modifying the ModSecurity configuration file (usually located at /etc/modsecurity/modsecurity.conf) and adding rules to exclude certain patterns. However, this is not a long-term solution and should only be used until the package is updated.
Conclusion
The vulnerabilities in the ModSecurity-Apache package pose significant risks to web application security. It is crucial for users to update their packages to the latest patched versions to mitigate these risks. Temporary workarounds can be employed, but they should not replace proper updates.
See every vulnerability recorded for modsecurity-apache →
FAQ
ModSecurity is an open-source web application firewall (WAF) that helps protect web applications by filtering and monitoring HTTP traffic.
The main vulnerabilities include improper handling of nested JSON objects, HTTP multipart requests, and file uploads, leading to denial of service and potential bypass of security restrictions.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file. Check your application at Vulert Scanner without needing to sign up.
If immediate updates are not possible, consider implementing temporary workarounds, such as disabling ModSecurity for specific requests, but be aware that this poses security risks.
Detailed information can be found in the Ubuntu Security Notices and the CVE entries associated with the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
