PT-2019-13349 · Owasp · Owasp Modsecurity Core Rule Set

Fgsch · Published 2019-07-09 · Updated 2023-01-30 · CVE-2019-13464

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OWASP ModSecurity Core Rule Set (CRS) version 3.0.2

Description An issue was discovered where the use of X.Filename instead of X Filename can bypass some PHP Script Uploads rules. This occurs because PHP automatically transforms dots into underscores in certain contexts where dots are invalid.

Recommendations For OWASP ModSecurity Core Rule Set (CRS) version 3.0.2, consider using X Filename instead of X.Filename to prevent bypassing of PHP Script Uploads rules. As a temporary workaround, review and update the existing rules to ensure they are not relying on the incorrect transformation of dots to underscores.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

AZL-44598

CVE-2019-13464

DLA-3293-1

Affected Products

Owasp Modsecurity Core Rule Set

References · 11

• 🔥 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1386 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-13464 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13464 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-13464 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-13464 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44598 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13464 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13464 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13464 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3293-1 · Vendor Advisory
• https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/1391 · Note