CVE-2021-45098
📋 TL;DR
This vulnerability allows attackers to bypass HTTP-based intrusion detection signatures in Suricata by sending a crafted RST TCP packet with random TCP options. Affected systems are those running vulnerable Suricata versions that inspect HTTP traffic, potentially allowing malicious traffic to go undetected.
💻 Affected Systems
- Suricata IDS/IPS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could deliver malware, exfiltrate data, or conduct other malicious HTTP activities without triggering Suricata alerts or blocking actions.
Likely Case
Evasion of specific HTTP-based detection rules, allowing targeted attacks to bypass network security monitoring.
If Mitigated
With proper patching, Suricata correctly handles RST packets with TCP options, maintaining full HTTP inspection capability.
🎯 Exploit Status
Exploitation requires network access to send crafted TCP packets. The technique is documented in the vulnerability disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.4 and 5.0.8
Vendor Advisory: https://forum.suricata.io/t/suricata-6-0-4-and-5-0-8-released/1942
Restart Required: Yes
Instructions:
1. Backup current Suricata configuration. 2. Update Suricata using package manager: 'sudo apt update && sudo apt upgrade suricata' (Debian/Ubuntu) or 'sudo yum update suricata' (RHEL/CentOS). 3. Restart Suricata service: 'sudo systemctl restart suricata'. 4. Verify version with 'suricata -V'.
🔧 Temporary Workarounds
Disable TCP MD5 Header Processing
allConfigure Suricata to ignore TCP MD5 header options which are rarely used in practice
Add 'tcp.md5: ignore' to suricata.yaml under decoder section
Use Alternative Detection Methods
allSupplement HTTP signatures with application-layer or behavioral detection rules
🧯 If You Can't Patch
- Implement network segmentation to limit exposure of vulnerable Suricata instances
- Deploy additional security controls like WAF or proxy servers to inspect HTTP traffic
🔍 How to Verify
Check if Vulnerable:
Check Suricata version: 'suricata -V'. If version is below 6.0.4 (for 6.x branch) or below 5.0.8 (for 5.x branch), system is vulnerable.Check Version:
suricata -V | head -1Verify Fix Applied:
After update, confirm version is 6.0.4+ or 5.0.8+ with 'suricata -V'. Test with known HTTP attack patterns to ensure detection works.📡 Detection & Monitoring
Log Indicators:
- Unexpected RST packets with TCP options in flow logs
- HTTP traffic that should trigger signatures but doesn't
Network Indicators:
- RST ACK packets with TCP options preceding HTTP requests
- HTTP GET requests to known malicious URLs without Suricata alerts
SIEM Query:
source="suricata" (event_type="alert" AND NOT alert.signature=*) | stats count by src_ip, dest_ip, http.hostname🔗 References
- https://forum.suricata.io/t/suricata-6-0-4-and-5-0-8-released/1942
- https://github.com/OISF/suricata/commit/50e2b973eeec7172991bf8f544ab06fb782b97df
- https://github.com/OISF/suricata/releases
- https://redmine.openinfosecfoundation.org/issues/4710
- https://forum.suricata.io/t/suricata-6-0-4-and-5-0-8-released/1942
- https://github.com/OISF/suricata/commit/50e2b973eeec7172991bf8f544ab06fb782b97df
- https://github.com/OISF/suricata/releases
- https://lists.debian.org/debian-lts-announce/2025/03/msg00029.html
- https://redmine.openinfosecfoundation.org/issues/4710
