CVE-2024-1019
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string component. This results in an impedance mismatch versus RFC compliant back-end applications. The vulnerability hides an attack payload in the path component of the URL from WAF rules inspecting it. A back-end may be vulnerable if it uses the path component of request URLs to construct queries. Integrators and users are advised to upgrade to 3.0.12. The ModSecurity v2 release line is not affected by this vulnerability.
- Affected products
- Alt Linux, Debian, Modsecurity, Red Os, Libmodsecurity
- Owasp Modsecurity
- < 3.0.12
- Fix
- Available
- CVSS 3.1
- 8.6 HIGH
- EPSS
- 0.7% (49th percentile)
- Weakness
- CWE-20
- NVD status
- Modified
- Published
- 2024-01-30
- Attack patterns
- CAPEC-152
Fix
Upgrade to ModSecurity 3.0.12.
Workaround
ModSecurity v3’s REQUEST_URI_RAW variable contains the full URI and is unaffected by the URL decoding step. It is therefore possible to use the REQUEST_URI_RAW variable to derive all other required variables correctly, including performing any required URL decoding.
No indexed exploits for CVE-2024-1019 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2024-1019 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.