#VU72089 Input validation error in OWASP ModSecurity Core Rule Set (CRS) - CVE-2022-39956

Vulnerability identifier: #VU72089

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-39956

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
OWASP ModSecurity Core Rule Set (CRS)
Server applications / Other server solutions

Vendor: OWASP

Description

The vulnerability allows a remote attacker to bypass filtration rules.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and inspected by the web application firewall engine and the rule set.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

OWASP ModSecurity Core Rule Set (CRS): 3.2.0 - 3.2.2, 3.3.0 - 3.3.3

---

External links
https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.