GHSA-qrch-pjfr-9g47: ModSecurity: removeComments Transformation Fails to Strip Adjacent Comments, Enabling WAF Rule Bypass
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msrefnremoveCommentsexecute in apache2/retfns.c and inplace() in src/actions/transformations/removecomments.cc implement t:removeComments by copying the character immediately after a comment terminator without re-evaluating it. Adjacent comments can therefore leave a later comment in the transformed value, allowing inline-comment obfuscation to bypass rules that depend on comment stripping. When a comment terminator is the final content, the same copy reads one byte beyond the input buffer. This issue is fixed in versions 2.9.15 and 3.0.17.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ModSecurityto a version that resolves this vulnerability.Fixed in 2.9.15 - Upgrade
Upgrade
ModSecurityto a version that resolves this vulnerability.Fixed in 3.0.17
Event History
Frequently Asked Questions
Which deployments are affected?
ModSecurity versions earlier than 2.9.15 and earlier than 3.0.17 are affected when rules rely on the t:removeComments transformation to normalize input before inspection. The issue applies to ModSecurity deployments for Apache, IIS, and Nginx.
What does an attacker need to do to bypass an affected rule?
An attacker can use adjacent inline comments in an input value. The flawed transformation may leave a later comment intact, allowing comment-based obfuscation to evade rules that depend on comments being stripped.
How can I assess exposure and remediate it?
Check the deployed ModSecurity version and identify rules using t:removeComments, particularly rules intended to detect obfuscated input after comment removal. Upgrade to ModSecurity 2.9.15 or 3.0.17, as applicable.