CVE-2024-1019

CVSS V2 None CVSS V3 None

Description

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string component. This results in an impedance mismatch versus RFC compliant back-end applications. The vulnerability hides an attack payload in the path component of the URL from WAF rules inspecting it. A back-end may be vulnerable if it uses the path component of request URLs to construct queries. Integrators and users are advised to upgrade to 3.0.12. The ModSecurity v2 release line is not affected by this vulnerability.

Overview

CVE ID
CVE-2024-1019

Assigner
NCSC.ch

Vulnerability Status
PUBLISHED

Published Version
2024-01-30T16:09:42.428Z

Last Modified Date
2024-01-30T16:09:42.428Z

Weakness Enumerations

CWE	URL
CWE-20	http://cwe.mitre.org/data/definitions/20.html

References

Reference URL	Reference Tags
https://owasp.org/www-project-modsecurity/tab_cves#cve-2024-1019-2024-01-30
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/34KDQNZE2RS3CWFG5654LNHKXXDPIW5I/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K6ZGABPJK2JPVH2JDFHZ5LQLWGONUH7V/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-1019
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1019

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 06:09:45				Added to TrackCVE