CVE-2023-24021 — Improper Null Termination in Modsecurity

CWE-170 — Improper Null TerminationCWE-402 — Resource Leak9 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 72.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Trustwave ModsecurityDebian Linux
Timeline
PublishedJan 20
Latest updateApr 15

Description

Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

Also affects: Debian Linux 10.0

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
modsecurity-apache vulnerabilities↗2023-09-14
▶
OSV
CVE-2023-24021: Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2↗2023-01-20
▶
GHSA
GHSA-845r-7x4c-q8qf: In ModSecurity before 2↗2023-01-20
▶
CVEList
CVE-2023-24021: Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2↗2023-01-20
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (ModSecurity) — CVE-2023-24021↗2024-04-15
▶
Ubuntu
ModSecurity vulnerabilities↗2023-09-14
▶
Red Hat
modsecurity: lacking the complete content in FILES_TMP_CONTENT leads to web application firewall bypass↗2023-01-20
▶
Debian
CVE-2023-24021: modsecurity-apache - Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may...↗2023
▶
CVE-2023-24021 — Improper Null Termination | cvebase