Bug 2131319 (CVE-2022-39957) - CVE-2022-39957 mod_security_crs: Charset accept header field resulting in response rule set bypass
Summary: CVE-2022-39957 mod_security_crs: Charset accept header field resulting in res...
Keywords:
Status: NEW
Alias: CVE-2022-39957
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2131320 2131348 2131349
Blocks: 2128790
TreeView+ depends on / blocked
 
Reported: 2022-09-30 17:07 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-10-07 13:58 UTC (History)
2 users (show)

Fixed In Version: mod_security_crs 3.2.2, mod_security_crs 3.3.3
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the OWASP ModSecurity Core Rule Set. A payload with a HTTP accept header field containing a charset that can't be decoded by the Web Application Firewall allows a response body bypass, resulting in access to restricted resources.
Clone Of:
Environment:
Last Closed:


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2022-09-30 17:07:40 UTC
The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web application firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.

Reference:
https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/

Comment 1 Guilherme de Almeida Suckevicz 2022-09-30 17:07:55 UTC
Created mod_security_crs tracking bugs for this issue:

Affects: fedora-all [bug 2131320]


Note You need to log in before you can comment on or make changes to this bug.