CVE-2025-47947
📋 TL;DR
ModSecurity versions up to 2.9.8 are vulnerable to a denial-of-service attack when processing JSON payloads with specific rule configurations. Attackers can crash the WAF by sending specially crafted JSON requests to applications protected by vulnerable ModSecurity installations. This affects all users running ModSecurity with rules using sanitiseMatchedBytes actions.
💻 Affected Systems
- ModSecurity
📦 What is this software?
Modsecurity by Trustwave
⚠️ Risk & Real-World Impact
Worst Case
Complete WAF service disruption leading to unprotected web applications and potential application downtime
Likely Case
Intermittent WAF crashes requiring service restarts, creating windows of vulnerability
If Mitigated
Minimal impact with proper monitoring and rapid response to service interruptions
🎯 Exploit Status
Exploitation requires sending HTTP requests with application/json content type to trigger vulnerable rule processing
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.9
Vendor Advisory: https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r
Restart Required: Yes
Instructions:
1. Download ModSecurity 2.9.9 or later from official repository. 2. Apply patch from pull request #3389 if using older version. 3. Recompile and reinstall ModSecurity. 4. Restart web server (Apache/Nginx/IIS).
🔧 Temporary Workarounds
Disable JSON processing for vulnerable rules
allTemporarily disable or modify rules using sanitiseMatchedBytes actions for JSON content
# Edit ModSecurity rules to exclude application/json from sanitiseMatchedBytes rules
# Example: Add '!@rx application/json' condition to vulnerable rules
🧯 If You Can't Patch
- Implement rate limiting on JSON endpoints to reduce DoS impact
- Deploy secondary WAF or load balancer with failover capabilities
🔍 How to Verify
Check if Vulnerable:
Check ModSecurity version and review rules for sanitiseMatchedBytes usage: modsecurity -V && grep -r 'sanitiseMatchedBytes' /path/to/rules/Check Version:
modsecurity -VVerify Fix Applied:
Verify version is 2.9.9 or later: modsecurity -V | grep 'Version'📡 Detection & Monitoring
Log Indicators:
- ModSecurity process crashes
- High volume of JSON requests with unusual patterns
- Rule processing errors for application/json content
Network Indicators:
- Spike in HTTP 500 errors
- Unusual JSON payload sizes or structures
SIEM Query:
source="modsec.log" AND ("crash" OR "segfault" OR "sanitiseMatchedBytes")