Buffer overflow in ModSecurity - CVE-2023-24021

Vulnerability identifier: #VU72086

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-24021

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when executing rules that read the FILES_TMP_CONTENT collection. A remote attacker can upload a specially crafted file on the system, trigger memory corruption and execute arbitrary code on the target system or bypass implemented WAF protection rules.

ModSecurity
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Enterprise Storage
Oracle Solaris
Ubuntu
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Server Applications
openSUSE Leap
Fedora
Oracle HTTP Server
libapache2-modsecurity (Ubuntu package)
libapache2-mod-security2 (Ubuntu package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
jbcs-httpd24-apr (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
apache2-mod_security2-debugsource
apache2-mod_security2-debuginfo
apache2-mod_security2
jbcs-httpd24-mod_security (Red Hat package)
mod_security
jbcs-httpd24-curl (Red Hat package)
JBoss Core Services

Install updates from vendor's website.

ModSecurity - update to 2.9.7
libapache2-modsecurity (Ubuntu package) - update to Ubuntu Pro
libapache2-mod-security2 (Ubuntu package) - addressed in versions Ubuntu Pro, 2.9.3-1ubuntu0.1
jbcs-httpd24-mod_proxy_cluster (Red Hat package) - addressed in versions 1.3.19-4.el7jbcs, 1.3.19-4.el8jbcs
jbcs-httpd24-apr-util (Red Hat package) - addressed in versions 1.6.1-102.el7jbcs, 1.6.1-102.el8jbcs
jbcs-httpd24-apr (Red Hat package) - addressed in versions 1.7.0-8.el7jbcs, 1.7.0-8.el8jbcs
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.19-28.el7jbcs, 1.15.19-28.el8jbcs
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.4.0-25.el7jbcs, 2.4.0-25.el8jbcs
JBoss Core Services - update to 2.4.57
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.57-5.el7jbcs, 2.4.57-5.el8jbcs
apache2-mod_security2-debugsource - addressed in versions 2.9.2-150000.3.9.1, 2.9.4-150400.3.6.1
apache2-mod_security2-debuginfo - addressed in versions 2.9.2-150000.3.9.1, 2.9.4-150400.3.6.1
apache2-mod_security2 - addressed in versions 2.9.2-150000.3.9.1, 2.9.4-150400.3.6.1
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.3-29.el7jbcs, 2.9.3-29.el8jbcs
mod_security - addressed in versions 2.9.7-1.fc36, 2.9.7-1.fc37, 2.9.7-1.fc38
jbcs-httpd24-curl (Red Hat package) - addressed in versions 8.2.1-1.el7jbcs, 8.2.1-1.el8jbcs

• https://github.com/SpiderLabs/ModSecurity/pull/2857/commits/4324f0ac59f8225aa44bc5034df60dbeccd1d334
• https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.7
• https://github.com/SpiderLabs/ModSecurity/pull/2857
• https://lists.debian.org/debian-lts-announce/2023/01/msg00023.html

• Buffer overflow in ModSecurity
• SUSE update for apache2-mod_security2
• SUSE update for apache2-mod_security2
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Red Hat JBoss Core Services
• Fedora 37 update for mod_security
• Fedora 36 update for mod_security
• Fedora 38 update for mod_security
• Ubuntu update for modsecurity-apache
• Multiple vulnerabilities in Oracle HTTP Server