SB2023020956 - Multiple vulnerabilities in OWASP ModSecurity Core Rule Set (CRS)
Published: February 9, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2022-39955)
The vulnerability allows a remote attacker to bypass filtration rules.
The vulnerability exists due to insufficient validation of user-supplied input when parsing HTTP Content-Type header field that indicates multiple character encoding schemes. A remote attacker send a specially crafted HTTP request and bypass the configurable CRS Content-Type header "charset" allow list.
2) Input validation error (CVE-ID: CVE-2022-39956)
The vulnerability allows a remote attacker to bypass filtration rules.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and inspected by the web application firewall engine and the rule set.
3) Input validation error (CVE-ID: CVE-2022-39957)
The vulnerability allows a remote attacker to bypass filtration rules.
The vulnerability exists due to insufficient validation of HTTP Accept header field containing an optional "charset" parameter. A remote attacker can send a specially crafted HTTP request and bypass WAF detection.
4) Input validation error (CVE-ID: CVE-2022-39958)
The vulnerability allows a remote attacker to bypass filtration rules.
The vulnerability exists due to insufficient validation of the HTTP Range header field with a small byte range. A remote attacker can exfiltrate small and undetectable sections of data by repeatedly submitting an HTTP Range header field with a small byte range.
Remediation
Install update from vendor's website.