PT-2023-27522 · Owasp · Owasp Coraza Waf

Rmb122 · Publicado 2023-06-26 · Atualizado 2023-09-01 · CVE-2023-40586

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions prior to 3.0.1

Description The issue is caused by the misuse of log.Fatalf in the OWASP Coraza WAF library, which leads to the application crashing after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in mime.ParseMediaType.

Recommendations For versions prior to 3.0.1, update to version 3.0.1 to resolve the issue. As a temporary workaround, consider modifying the error handling in the mime.ParseMediaType function to return directly instead of using log.Fatalf, which calls os.Exit and causes the application to crash.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2023-40586

GHSA-C2PJ-V37R-2P6H

GO-2023-1874

Produtos afetados

Owasp Coraza Waf

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40586.json · Exploit
• https://github.com/golang/go/blob/a031f4ef83edc132d5f49382bfef491161de2476/src/log/log.go#L288-L291 · Nota
• https://github.com/corazawaf/coraza · Nota
• https://github.com/corazawaf/coraza/commit/a5239ba3ce839e14d9b4f9486e1b4a403dcade8c · Correção
• https://github.com/corazawaf/coraza/commit/24af0c8cf4f10bab558740b595712be3b85493ec · Nota
• https://github.com/corazawaf/coraza/security/advisories/GHSA-c2pj-v37r-2p6h · Aviso do Fabricante
• https://github.com/corazawaf/coraza/releases/tag/v3.0.1 · Nota
• https://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.go#L26-L29 · Nota
• https://github.com/corazawaf/coraza/commit/e1b119b83e12c64f0957e00e8cad45a1b5f012f8 · Nota
• https://github.com/corazawaf/coraza-caddy/issues/48 · Nota
• https://twitter.com/VulmonFeeds/status/1695205492845343211 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-40586 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-40586 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1874 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-c2pj-v37r-2p6h · Aviso do Fabricante