Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`
Vulnerability Description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza will set a wrong value in REQUEST_FILENAME. For example, if the URI //bar/uploads/foo.php?a=b is passed to coraza: , REQUEST_FILENAME will be set to /uploads/foo.php. This can lead to a rules bypass. This vulnerability is fixed in 3.3.3.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Vulnerability Type
使用不正确的解析名称或索引
Vulnerability Title
OWASP Coraza WAF 安全漏洞
Vulnerability Description
OWASP Coraza WAF是Coraza开源的一个 golang modsecurity 兼容的 Web 应用程序防火墙库。 OWASP Coraza WAF 3.3.3之前版本存在安全漏洞，该漏洞源于对以//开头的URI请求处理不当，可能导致规则绕过。
CVSS Information
N/A
Vulnerability Type
N/A