Protection mechanism failure in OWASP ModSecurity Core Rule Set (CRS) - CVE-2021-35368
Published: July 1, 2021
Vulnerability identifier: #VU54495
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-35368
CWE-ID: CWE-693
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures within the default CRS ruleset. An attacker can bypass implemented security restrictions and exploit vulnerabilities in the CMS that is protected with ModSecurity with the OWASP ModSecurity Core Rule Set (CRS).
Affected software
OWASP ModSecurity Core Rule Set (CRS)
EasyApache
Gentoo Linux
Fedora
libmodsecurity
www-apache/modsecurity-crs
EasyApache
Gentoo Linux
Fedora
libmodsecurity
www-apache/modsecurity-crs
How to mitigate CVE-2021-35368
Install updates from vendor's website.
OWASP ModSecurity Core Rule Set (CRS) - addressed in versions 3.1.2, 3.2.1, 3.3.2
EasyApache - addressed in versions 4 2021-6-30, 4 2021-7-7
libmodsecurity - addressed in versions 3.0.8-1.fc36, 3.0.8-1.fc37, 3.0.9-2.el7
www-apache/modsecurity-crs - update to 3.3.4
EasyApache - addressed in versions 4 2021-6-30, 4 2021-7-7
libmodsecurity - addressed in versions 3.0.8-1.fc36, 3.0.8-1.fc37, 3.0.9-2.el7
www-apache/modsecurity-crs - update to 3.3.4
External References
Related Security Bulletins
- WAF ruleset bypass in OWASP ModSecurity Core Rule Set (CRS)
- CPanel EasyApache 4 security update for OWASP ModSecurity Core Rule Set (CRS)
- Multiple vulnerabilities in cPanel EasyApache
- Gentoo update for OWASP ModSecurity Core Rule Set
- Fedora EPEL 7 update for libmodsecurity
- Fedora 37 update for libmodsecurity
- Fedora 36 update for libmodsecurity