CVE-2024-21747: Multipart form-data parser bypass via embedded line breaks

Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass Vulnerability Overview Vulnerability Name: Multipart form-data parser silently strips embedded line breaks from form-field values, enabling request-body inspection bypass Vulnerability ID: GHSA-295r-7p88 Publish Date: January 25, 2024 Severity: High (8.6/10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Confidentiality: None - Integrity: High - Availability: None Scope of Impact Affected Versions: <= v3.0.15 Fixed Version: v3.0.16 CVE ID: CVE-2024-21747 Remediation Fixed Version: v3.0.16 Fix Code: Proof of Concept (PoC) Code Observed Output Cleanup Final Re-verification After drafting, the above compilation and execution commands were re-run from the repository root directory, producing the same output. Impact ModSecurity typically operates as a secondary security gateway between the HTTP client and the backend application. In default/recommended settings, request body access is enabled, and requests are parsed into / for Stage 2 rule checking. Because embedded field line breaks are silently stripped before rule evaluation, rules may inspect values that differ from those received by the application. This can bypass detection or blocking rules where line breaks are semantically significant, such as when parsing sensitive payloads, multi-line file objects, or requests dependent on delimiter matching. The issue is particularly critical because this vulnerability breaks strict multipart validation rules, which do not detect the discrepancy: , , and remain 0 in the proof of concept. The proof of concept does not demonstrate memory corruption, data leakage, or denial of service. The confirmed security impact is the integrity of request-body inspection: the values visible to the rules may differ from those visible to the backend. Suggested Fix When appending form data blocks, within the branch, append the reserved bytes after appending the current buffer, rather than overwriting the target string, for example: Add regression tests for multipart form fields containing embedded and . The tests should assert that preserves line breaks and that strict multipart validation rules remain unchanged.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-21747: Multipart form-data parser bypass via embedded line breaks

More from this source