Login Sign Up

CVE-2021-35368

9.8 CRITICAL

📋 TL;DR

This vulnerability allows attackers to bypass ModSecurity Core Rule Set request body inspection by appending a trailing pathname to requests. This affects web applications using vulnerable CRS versions, potentially allowing malicious payloads to reach backend applications.

💻 Affected Systems

Products:
  • OWASP ModSecurity Core Rule Set
Versions: 3.1.x before 3.1.2, 3.2.x before 3.2.1, 3.3.x before 3.3.2
Operating Systems: All
Default Config Vulnerable: ⚠️ Yes
Notes: Affects any system using vulnerable CRS versions with ModSecurity enabled.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Owasp Modsecurity Core Rule Set by Owasp

View all CVEs affecting Owasp Modsecurity Core Rule Set →

Owasp Modsecurity Core Rule Set by Owasp

View all CVEs affecting Owasp Modsecurity Core Rule Set →

Owasp Modsecurity Core Rule Set by Owasp

View all CVEs affecting Owasp Modsecurity Core Rule Set →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers can bypass all request body inspection rules, potentially delivering SQL injection, XSS, RCE, or other payloads directly to vulnerable applications.

🟠

Likely Case

Attackers bypass specific security controls, enabling injection attacks that would normally be blocked by CRS rules.

🟢

If Mitigated

With proper patching and defense-in-depth controls, impact is limited as other security layers may still detect malicious activity.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires appending a trailing pathname to bypass request body parsing.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 3.1.2, 3.2.1, or 3.3.2

Vendor Advisory: https://coreruleset.org/20210630/cve-2021-35368-crs-request-body-bypass/

Restart Required: Yes

Instructions:

1. Update CRS to patched version. 2. Restart web server/ModSecurity. 3. Verify rules are loading correctly.

🔧 Temporary Workarounds

Custom Rule to Block Trailing Pathnames

all

Add custom ModSecurity rule to detect and block requests with trailing pathnames used for bypass.

SecRule REQUEST_URI "@rx \\.\\.?/" "id:999999,phase:1,deny,status:400,msg:'Potential CRS bypass attempt'"
SecRule REQUEST_URI "@rx /[^/]+/\\.\\.?/" "id:999998,phase:1,deny,status:400,msg:'Potential CRS bypass attempt'"
SecRule REQUEST_URI "@rx /[^/]+/[^/]+/\\.\\.?/" "id:999997,phase:1,deny,status:400,msg:'Potential CRS bypass attempt'"

🧯 If You Can't Patch

  • Implement WAF with updated CRS rules in front of vulnerable system
  • Deploy additional application-layer security controls and monitoring

🔍 How to Verify

Check if Vulnerable:

Check CRS version in ModSecurity configuration or rule files. Look for version numbers in the affected ranges.

Check Version:

grep -r "OWASP_CRS" /etc/modsecurity/ or check rule files for version headers

Verify Fix Applied:

Verify CRS version is 3.1.2, 3.2.1, or 3.3.2 or higher. Test with known bypass payloads to confirm blocking.

📡 Detection & Monitoring

Log Indicators:

  • Requests with unusual trailing pathnames (e.g., /path/../)
  • ModSecurity rule bypass alerts
  • Increased blocked requests after patch

Network Indicators:

  • HTTP requests containing /../ or /./ patterns in unusual positions
  • Requests that bypass expected WAF filtering

SIEM Query:

source="modsecurity" AND ("bypass" OR "/../" OR "/./")

📊 Metadata

CVE ID: CVE-2021-35368
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: November 5, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON