Coraza WAF Pre-Auth ARGS_GET/QUERY_STRING Bypass via ProcessURI Parse Failure (CVE-2024)

Vulnerability Overview Vulnerability Name: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations Vulnerability Description: When returns an error (e.g., the URI contains control bytes), the error branch silently generates empty and empty collections. The fallback logic, which was intended to split on and populate GET parameters, is commented out in the actual code, resulting in and being empty. Impact: , , and (union) are empty because is not called. is empty (initial query is , persisted to at line 835). / include any query suffix present in the original URI (because at line 839 bypasses parsing). is set to the Go error message; operators cannot distinguish between a "malformed URI" and a "malformed request body". is populated correctly (unconditionally set at line 822). Attack Complexity: High (Standard Go HTTP deployments are unaffected; only non-net/http integrations are exposed). CVSS Score: 4.0 / 10 (Medium) Scope of Impact Affected Versions: (Go) Versions >= 3.0.0, < 3.8.0 Fixed Version: 3.8.0 Affected Integrations: : HAProxy SPOA proxy : Envoy WASM filter Custom FFI/WASM hosts and any embedders calling Remediation 1. Re-enable the existing fallback logic and wire up - The code already exists in at lines 840-851. Re-enable it, promote the referenced to a real transaction variable, and populate / . 2. Send a companion rule in - Add a rule to fail closed by default (similar to rule 200003 for strict parse errors and rule 200002 for body parse errors), so that non-net/http integrations stop the request at least, regardless of downstream rule overrides. 3. Do not overload - The current code uses for URI parse failures. This variable is also set by the URL-encoded body processor. Operators cannot distinguish between these two scenarios without string-matching the error text; any rule would trigger on both types of failures. A dedicated variable (as indicated by the commented-out TODOs) is the correct approach. Proof of Concept (POC) Observations: : = , = 1 entry, = yes (403) : = , = 0 entries, = no — BYPASS : = , = 0 entries, = no — BYPASS : = , = 0 entries, = no — BYPASS : = , = 0 entries, = no — BYPASS HTTP Layer Reachability Check (stock net/http): Confirms that the exposure is limited to non-net/http integrations.

Goal Reached Thanks to every supporter — we hit 100%!

Coraza WAF Pre-Auth ARGS_GET/QUERY_STRING Bypass via ProcessURI Parse Failure (CVE-2024)

More from this source