This also applies to end-of-life CRS versions 3.0.x, 3.1.0, 3.1.1, as well as the currently supported versions 3.2.0 and 3.3.0. All known CRS installations that offer the predefined CRS rule exclusion packages are affected. Howe reported the two bugs in the CRS in June. The flaw was discovered and reported by Andrew Howe from, who reviewed the ModSecurity engine last year, Folini said. The important part now is learning our lesson and adopting our development and review process to avoid such failures in the future.” And as we to realize now, nobody has really reviewed this part of the code in the meantime, probably also thanks to the misconception that bugs within the rule exclusion packages would have limited impact since they are disabled by default. YOU MAY LIKE CVE board slams Distributed Weakness Filing project for publishing ‘unauthorized’ CVE records “When we did the early rule exclusion packages in 20 we were not really used to the rule writing techniques that we had to employ,” Folini explained. If the backend looks into the trailing path info as it should, then you are on the safe side,” it reads.Ĭhristian Folini, co-lead of the volunteer-led Core Rule Set project, told The Daily Swig that the flaw has “been around for several years”. “If the backend is broken and configured with the correct trailing pathname information setting… then anything is possible.

The risk to websites depends on their ModSecurity configuration, a write-up details. The vulnerability is not limited to Drupal installations, however, but is present in every CRS installation that includes these rule exclusions – regardless of whether they are enabled or not. This means that malicious request body payloads are able to pass the rule set without being inspected, due to a combination of two bugs in the CRS Drupal rule exclusion package.

The bug – tracked as CVE-2021-35368 – bypasses the security protections offered by the in-built CRS web application firewall (WAF), an advisory warns.

High-scoring bug went unnoticed due to time and money constraintsĪ vulnerability in the OWASP ModSecurity Core Rule Set (CRS) project that could allow attackers to bypass security mechanisms was present for several years, the maintainers have admitted.

Owasp 3.0 ruleset