Exploit for CVE-2026-21876

kitploit · 2026-08-26

Description

OWASP CRS WAF bypass via Spring Boot Undertow and ASP.NET allows reconstructed payloads through.

Affected Owasp Owasp Modsecurity Core Rule Set versions

Owasp Owasp Modsecurity Core Rule Set< 3.3.8, 4.22.0

All known vulnerabilities by product

Coraza Debian Modsecurity Owasp Core Rule Set

CVSS 9.3 for CVE-2026-21876

9.3

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:LOW

Availability:NONE

EPSS Score

13.6%higher than 96.3% of all CVEs

Updated 2026-08-29

CVE Information

References

https://github.com/airween

https://github.com/coreruleset/coreruleset/security/advisories/GHSA-36fv-25j3-r2c5

https://github.com/fzipi

Exploit Details

Modified:2026-08-26 21:44

Last Seen:2026-08-26 22:36

Reporter:KitPloit

Tags

OWASP CRSWAF bypassSpring Boot UndertowASP.NETpayload reconstruction

Other exploits for CVE-2026-21876

2026-08-27 KitPloitKITPLOIT

2026-08-27 KitPloitKITPLOIT

coreruleset 4.21.0 - Firewall Bypass

2026-05-13 anonimicerumEXPLOITDBPython

📄 OWASP CRS WAF Bypass

2026-02-23 daytriftnewgenPACKETSTORM

Exploit for CVE-2026-21876

2026-01-07 daytriftnewgenGITHUB

Exploit Code

MARKDOWN23 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-DAYTRIFTNEWGEN-CVE-2026-21876
# CVE-2026-21876 (OWASP CRS WAF-Bypass)

CVE-2026-21876 Docker-Container + minimaler PoC.

Ich möchte mich separat bei @airween und @fzipi für ihre schnelle Reaktion bedanken! Der Fix für die Schwachstelle war in sehr kurzer Zeit fertig.

# PoC

Ausführen:

root@kitploit:~
    
    
    cd springboot_undertow_stand # or aspnet_stand
    docker compose up --build
    python3 demo/send.py            # BASELINE -> 403, BYPASS -> 200 + reconstructed payload
    

# Referenzen

  * GitHub-Sicherheitsbericht
  * OWASP-CRS-Walkthrough-Blogbeitrag