4 ms·
Lessons Learned: A severe vulnerability in the OWASP ModSecurity Core Rule Set
- hunter2_ 5y ago> it looks like we’re doing the right thing here I'm inclined to agree. No downplaying the severity, no BS tone à la free credit monitoring handouts, just genuine taking of responsibility.
- twic 5y agoWhat is an OWASP ModSecurity Core Rule Set?
- hunter2_ 5y agoModSecurity is a module you can add to Apache httpd which acts as a web application firewall (WAF) meaning that it inspects HTTP traffic for threats and conditionally blocks requests from being processed. Threats are determined based on various rules you can write yourself or obtain from elsewhere. One of the more popular sets of rules is written/maintained by the Open Web Application Security Project (OWASP) Foundation.
- WelcomeShorty 5y agoHat tip for the public handling of this issue. Second one for the initiation of a bug bounty, while not the end to all, it does help to get critical hands and eyes to your code.
- EE84M3i 5y agoLooks like the writeup from the ModSecurity folks is here: https://coreruleset.org/20210630/cve-2021-35368-crs-request-body-bypass/ https://coreruleset.org/20210630/cve-2021-35368-crs-request-... perhaps it's better to change the URL? The explanation is a little hard for me to follow, but it sounds to me like it works like if you have a php file /foo/bar.php, you can always run that as /foo/bar.php/biz/baz (this is a standard php/apache feature). The bypass is if you make requests to /foo/bar.php/admin/content/assets/add/blah then there is no request body inspection. IMO, calling this a "severe vulnerability in ModSecurity" though is a little silly. WAFs always have false negatives by design. My first interpretation was that it would be an RCE on the apache daemon or something.
- tptacek 5y agoI had the same reaction. Even a universal WAF bypass wouldn't raise that many eyebrows, but a ModSecurity bypass? Don't build systems whose security depends on ModSecurity!