CrowdSec AppSec Request Body Parsing Bypass Vulnerability

Vulnerability Overview An security vulnerability exists in CrowdSec AppSec regarding HTTP request body handling, which causes it to silently discard the request body. Specifically, when the request is not a positive number (specifically when using or for HTTP/2 requests lacking a header), CrowdSec treats the request body as empty. This causes all WAF rules targeting , , , , or to fail. Attackers can bypass the entire AppSec inspection pipeline by modifying a single frame header, allowing malicious requests to pass through without generating WAF logs. Scope of Impact Affected Versions: CrowdSec 1.5.0 to 1.7.7 Affected Component: function in Remediation Fixed Version: 1.7.8 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Confidentiality: Low - Integrity: Low - Availability: None POC Code Root Cause The Go server sets to -1 when a request uses and lacks a header, or for HTTP/2 requests containing a pseudo-header (DATA frame body). When : 1. evaluates to 0. 2. allocates a zero-length slice. 3. requires zero bytes on a zero-length buffer and returns immediately without accessing . 4. An empty buffer is written back to the request and a cloned request is constructed within the same function. Every downstream consumer within the AppSec runner sees an empty request body. is skipped because the parsed request body length is zero, causing to run against empty content. Impact Any request that results in a non-positive will bypass any request body scanning rules. In default CrowdSec deployments using standard AppSec collections, the bypass affects any rules containing , , , , or sections. There are no configuration options to mitigate this issue—the defect lies within the request parser, not any rule set. Bypassed requests do not generate WAF log entries, providing operators with no signal that rules were skipped. Only header and URI rules remain unaffected. Workarounds No complete workaround is currently available.

Goal Reached Thanks to every supporter — we hit 100%!

CrowdSec AppSec Request Body Parsing Bypass Vulnerability

More from this source