mod_security_crs v4.25.2 has been added to the CodeIT repository. mod_security_crs is the OWASP CRS rule set for ModSecurity. The packages are built for RHEL, CentOS, AlmaLinux, Rocky Linux and Oracle Linux 8 and 9, and for Ubuntu 22.04 and 24.04.
This update fixes security vulnerabilities. Upgrading is recommended.
Major changes:
- Backport false positive fix for the `vega` scanner user agent substring matching `veganism.social` (rule 913100) (Esad Cetiner, cherry-pick of #4777)
- Backport fix so `tx.crs_skip_response_analysis` also skips the phase 4 response body rules; previously only the phase 3 header rules were skipped (new rule 950022) (Jozef Sudolský, cherry-pick of #4807)
- Backport allowing and JSON-parsing `application/*+json` content types (including subtypes that contain a `+`, such as `application/vc+ld+json`) and the AWS `application/x-amz-json-1.0`/`1.1` content types by default, so these JSON request bodies are no longer blocked by the content-type allow-list or left uninspected (new rules 901360, 901370) (Felipe Zipitría, cherry-pick of #4775 and #4828)
Fixed vulnerabilities:
- Backport fix for [GHSA-575j-qr6p-9763] via adding `REQUEST_FILENAME` to the targets of the RCE rules, so command injection payloads placed in the URL path are inspected like those in `ARGS` (rules 932125-932390, except 932200, where every URL path contains the `/` it requires) (Max Leske)
- Backport fix for [GHSA-89h9-2j8h-9gp2] via lowercasing the `charset` parameter name before matching, so an uppercase or mixed-case `CHARSET=` in `Content-Type` can no longer skip the charset allow-list check (rule 920480) (Felipe Zipitría)
- Backport fix for [GHSA-qmx4-jfcv-fgww] via collecting every `_charset_` value so a second multipart part or a query-string `_charset_` can no longer shadow a disallowed charset (rule 922100) (Ervin Hegedüs)
- Backport fix removing a bypassable length bound in the SQL `(X)OR` injection detection (rule 942390) (Felipe Zipitría, cherry-pick of #4713)
- Backport fix for [V29-260924] via tolerating trailing slashes as well as dots after the extension, so a PHP or JSP upload filename ending in `/` can no longer bypass the upload extension checks (rules 933110, 944140) (Felipe Zipitría, cherry-pick of #4815)
- Formalize rule 932171 (Shellshock, CVE-2014-6271) into a `regex-assembly` file and apply the standard `[sx0b]` whitespace-class normalization; the `json.` ARGS_NAMES prefix detection itself was already present on this branch via an untracked fix, so this is a maintainability/consistency change, not a functional fix (partial cherry-pick of #4703)