Log in Start free

Vulnerability · Published Jan 30, 2024 · Assigned by NCSC.ch

CVE-2024-1019WAF bypass of the ModSecurity v3 release line

High 8.6

In plain English

A high-severity improper input validation in ModSecurity from OWASP ModSecurity. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.7%top 47.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string component. This results in an impedance mismatch versus RFC compliant back-end applications. The vulnerability hides an attack payload in the path component of the URL from WAF rules inspecting it. A back-end may be vulnerable if it uses the path component of request URLs to construct queries. Integrators and users are advised to upgrade to 3.0.12. The ModSecurity v2 release line is not affected by this vulnerability.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12modsecurityno fix listedDEBIAN-CVE-2024-1019
Debian:13modsecurity3.0.12-1DEBIAN-CVE-2024-1019
Debian:14modsecurity3.0.12-1DEBIAN-CVE-2024-1019
Ubuntu:22.04:LTSmodsecurityno fix listedUBUNTU-CVE-2024-1019
Ubuntu:24.04:LTSmodsecurityno fix listedUBUNTU-CVE-2024-1019
Ubuntu:25.10modsecurityno fix listedUBUNTU-CVE-2024-1019
Ubuntu:26.04:LTSmodsecurityno fix listedUBUNTU-CVE-2024-1019
Ubuntu:26.10modsecurityno fix listedUBUNTU-CVE-2024-1019

Affected products (as reported)

VendorProductVersions
OWASP ModSecurity ModSecurity 3.0.0 – through 3.0.11

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References