ModSecurity: Response Body Inspection Bypass

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries case-sensitively. A mixed-case response media type that is semantically equivalent to a configured lowercase type can therefore be treated as unconfigured, causing ModSecurity to skip RESPONSE_BODY inspection. An unauthenticated requester can then receive response content that a phase 4 rule would otherwise block, including sensitive error or debug data. This issue is fixed in version 3.0.17.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…curity/security/advisories/GHSA-vmg8-j66p-vgvw Diğer
• github.com/…ommit/23ccd9202114f8313df3773f7992782fd9949c98 Diğer
• github.com/…p-modsecurity/ModSecurity/releases/tag/v3.0.17 Diğer

Kayıt geçmişi

1. 5 Kas 2026 18:50Yayımlandı

İlgili açıklar

• 8,6 CVE-2026-104269ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)
• 3,7 CVE-2026-61813ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download
• 5,8 CVE-2026-103932ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
• 6,5 CVE-2026-85287HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service
• 7,1 CVE-2026-123012Gogs Git Smart HTTP yetkilendirmesinde yalnızca okuma erişiminde push izni verilmesi
• 6,3 CVE-2026-63121Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules