PT-2023-27522 · Owasp · Owasp Coraza Waf

Rmb122 · Published 2023-06-26 · Updated 2023-09-01 · CVE-2023-40586

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OWASP Coraza WAF versions prior to 3.0.1

Description The issue is caused by the misuse of log.Fatalf in the OWASP Coraza WAF library, which leads to the application crashing after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in mime.ParseMediaType.

Recommendations For versions prior to 3.0.1, update to version 3.0.1 to resolve the issue. As a temporary workaround, consider modifying the error handling in the mime.ParseMediaType function to return directly instead of using log.Fatalf, which calls os.Exit and causes the application to crash.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-40586

GHSA-C2PJ-V37R-2P6H

GO-2023-1874

Affected Products

Owasp Coraza Waf

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40586.json · Exploit
• https://github.com/corazawaf/coraza/commit/a5239ba3ce839e14d9b4f9486e1b4a403dcade8c · Patch
• https://github.com/corazawaf/coraza/security/advisories/GHSA-c2pj-v37r-2p6h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40586 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40586 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1874 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c2pj-v37r-2p6h · Vendor Advisory
• https://github.com/golang/go/blob/a031f4ef83edc132d5f49382bfef491161de2476/src/log/log.go#L288-L291 · Note
• https://github.com/corazawaf/coraza · Note
• https://github.com/corazawaf/coraza/commit/24af0c8cf4f10bab558740b595712be3b85493ec · Note
• https://github.com/corazawaf/coraza/releases/tag/v3.0.1 · Note
• https://github.com/corazawaf/coraza/blob/82157f85f24c6107667bf0f686b71a72aafdf8a5/internal/bodyprocessors/multipart.go#L26-L29 · Note
• https://github.com/corazawaf/coraza/commit/e1b119b83e12c64f0957e00e8cad45a1b5f012f8 · Note
• https://github.com/corazawaf/coraza-caddy/issues/48 · Note
• https://twitter.com/VulmonFeeds/status/1695205492845343211 · Twitter Post