CVE-2025-54571: ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can override the HTTP response’s Content-Type, which could lead to several issues depending on the HTTP scenario. For example, we have demonstrated the potential for XSS and arbitrary script source code disclosure in the latest version of modsecurity2. This issue is fixed in version 2.9.12.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54571?
CVE-2025-54571 has been classified as a moderate severity vulnerability, as it allows attackers to manipulate the HTTP response's Content-Type.
How do I fix CVE-2025-54571?
To mitigate CVE-2025-54571, update ModSecurity to version 2.9.12 or later.
Which versions of ModSecurity are affected by CVE-2025-54571?
CVE-2025-54571 affects ModSecurity versions 2.9.11 and below.
What impact does CVE-2025-54571 have on web application security?
The vulnerability can lead to various security issues by allowing attackers to override the Content-Type header in HTTP responses.
Is there a work-around for CVE-2025-54571 if I cannot upgrade?
While upgrading is the best option, consider implementing strict input validation and response headers as a temporary mitigation strategy.