CVE-2023-40586: go package github.com/corazawaf/coraza is vulnerable to denial of service
Summary
Due to the misuse of log.Fatalf, the application using coraza crashed after receiving crafted requests from attackers.
Details
https://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.go#L26-L29 The bodyprocessors of multipart uses log.Fatalf to handle errors from the mime.ParseMediaType, but log.Fatalf calls os.Exit directly after logging the error. https://github.com/golang/go/blob/a031f4ef83edc132d5f49382bfef491161de2476/src/log/log.go#L288-L291 This means that the application will immediately crash after receiving a malicious request that triggers an error in mime.ParseMediaType.
PoC
The server can be demonstrated by https://github.com/corazawaf/coraza/tree/main/examples/http-server
After sending this request POST / HTTP/1.1 Host: 127.0.0.1:8090 User-Agent: curl/8.1.2 Accept: / Content-Length: 199 Content-Type: multipart/form-data; boundary=------------------------5fa6351b877326a1; a=1; a=2 Connection: close
--------------------------5fa6351b877326a1 Content-Disposition: form-data; name="file"; filename="123" Content-Type: application/octet-stream
123
--------------------------5fa6351b877326a1--
The server will crash immediately. The a=1; a=2 in Content-Type makes mime: duplicate parameter name error.
Impact
I believe the vulnerability was introduced by the following commit: https://github.com/corazawaf/coraza/commit/24af0c8cf4f10bab558740b595712be3b85493ec.
Mitigation
The error from mime.ParseMediaType should return directly.
Other sources
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of log.Fatalf, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in mime.ParseMediaType. This issue was patched in version 3.0.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40586?
CVE-2023-40586 has a moderate severity due to the potential for application crashes when receiving specially crafted requests.
How do I mitigate CVE-2023-40586?
To mitigate CVE-2023-40586, update to Coraza version 3.0.1 or newer.
Which versions of Coraza are affected by CVE-2023-40586?
CVE-2023-40586 affects Coraza versions 2.0.0 to 2.0.1 and 3.0.0.
Does CVE-2023-40586 allow for remote code execution?
CVE-2023-40586 does not allow for remote code execution, but it can cause application crashes.
What should I do if I can't upgrade to fix CVE-2023-40586 immediately?
If an immediate upgrade is not possible for CVE-2023-40586, consider implementing additional request validation and monitoring to detect potential abuse.