Lessons Learned: A severe vulnerability in the OWASP ModSecurity Core Rule Set

portswigger.net

55 points·feross··6 comments

Looks like the writeup from the ModSecurity folks is here: https://coreruleset.org/20210630/cve-2021-35368-crs-request-... perhaps it's better to change the URL?

The explanation is a little hard for me to follow, but it sounds to me like it works like if you have a php file /foo/bar.php, you can always run that as /foo/bar.php/biz/baz (this is a standard php/apache feature). The bypass is if you make requests to /foo/bar.php/admin/content/assets/add/blah then there is no request body inspection.

IMO, calling this a "severe vulnerability in ModSecurity" though is a little silly. WAFs always have false negatives by design. My first interpretation was that it would be an RCE on the apache daemon or something.

I had the same reaction. Even a universal WAF bypass wouldn't raise that many eyebrows, but a ModSecurity bypass? Don't build systems whose security depends on ModSecurity!

> it looks like we’re doing the right thing here

I'm inclined to agree. No downplaying the severity, no BS tone à la free credit monitoring handouts, just genuine taking of responsibility.

Hat tip for the public handling of this issue. Second one for the initiation of a bug bounty, while not the end to all, it does help to get critical hands and eyes to your code.

What is an OWASP ModSecurity Core Rule Set?

ModSecurity is a module you can add to Apache httpd which acts as a web application firewall (WAF) meaning that it inspects HTTP traffic for threats and conditionally blocks requests from being processed. Threats are determined based on various rules you can write yourself or obtain from elsewhere. One of the more popular sets of rules is written/maintained by the Open Web Application Security Project (OWASP) Foundation.

Reply on news.ycombinator.com