CVE-2024-1019: WAF bypass of the ModSecurity v3 release line
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string component. This results in an impedance mismatch versus RFC compliant back-end applications. The vulnerability hides an attack payload in the path component of the URL from WAF rules inspecting it. A back-end may be vulnerable if it uses the path component of request URLs to construct queries. Integrators and users are advised to upgrade to 3.0.12. The ModSecurity v2 release line is not affected by this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ModSecurity / libModSecurityto a version that resolves this vulnerability.Fixed in 3.0.12
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1019?
CVE-2024-1019 is considered a medium severity vulnerability due to its potential for WAF bypass.
How do I fix CVE-2024-1019?
To fix CVE-2024-1019, upgrade ModSecurity to a version higher than 3.0.11.
What versions of ModSecurity are affected by CVE-2024-1019?
CVE-2024-1019 affects ModSecurity versions from 3.0.0 to 3.0.11.
What is the impact of CVE-2024-1019?
CVE-2024-1019 allows attackers to bypass security controls by crafting specific request URLs.
Who is responsible for addressing CVE-2024-1019?
The maintainers of ModSecurity are responsible for addressing CVE-2024-1019 by providing patches and updates.