PT-2023-6757 · Apache+4 · Apache+4

Coldtobi · Published 2023-01-20 · Updated 2024-03-06 · CVE-2023-24021

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions ModSecurity versions prior to 2.9.7

Description The issue is related to errors in security settings of the WAF engine for Apache ModSecurity. It may allow a remote attacker to bypass existing firewall rules. The problem also involves incorrect handling of '0' bytes in file uploads, which can lead to Web Application Firewall bypasses and buffer over-reads when executing specific rules that read the FILES TMP CONTENT collection.

Recommendations For ModSecurity versions prior to 2.9.7, update to version 2.9.7 or later to resolve the issue. As a temporary workaround, consider restricting file uploads or disabling rules that read the FILES TMP CONTENT collection until a patch is available. Restrict access to the Web Application Firewall to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-402

CWE-170

Related Identifiers

AZL-43843

AZL-44475

BDU:2023-07547

BIT-MODSECURITY-2023-24021

BIT-MODSECURITY2-2023-24021

CVE-2023-24021

DLA-3283-1

MGASA-2023-0175

OPENSUSE-SU-2023_0431-1

RHSA-2023:4629

SUSE-SU-2023:0431-1

SUSE-SU-2023:0447-1

SUSE-SU-2023_0431-1

SUSE-SU-2023_0447-1

USN-6370-1

Affected Products

Apache

Linuxmint

Modsecurity

Suse

Ubuntu

References · 39

• https://github.com/SpiderLabs/ModSecurity/pull/2857 · Patch
• https://github.com/SpiderLabs/ModSecurity/pull/2857/commits/4324f0ac59f8225aa44bc5034df60dbeccd1d334 · Patch
• https://osv.dev/vulnerability/CVE-2023-24021 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44475 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3283-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24021 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-24021 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-modsecurity-2023-24021 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6370-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48279 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6370-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07547 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/52TGCZCOHYBDCVWJYNN2PS4QLOHCXWTQ · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYRTXTOQQI6SB2TLI5QXU76DURSLS4XI · Vendor Advisory
• https://osv.dev/vulnerability/AZL-43843 · Vendor Advisory