ModSecurity multipart parser filename* mismatch bypasses file checks
File names that the web firewall never checked can reach your app.
Summary
The ModSecurity WAF engine's multipart parser reads the filename* parameter differently from the backend, so a file name that skipped inspection can reach the application. Versions from 3.0.0 until before 3.0.17 are affected.
Affected when
- Go, Python, Node.js or Java backend applications
- ModSecurity 3.0.0 or later, before 3.0.17
What to do
Update to ModSecurity 3.0.17.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen