CVE-2022-39956: 
ModSecurity vulnerability analysis and mitigation

The OWASP ModSecurity Core Rule Set (CRS) was affected by a partial rule set bypass vulnerability (CVE-2022-39956) discovered in September 2022. The vulnerability affects HTTP multipart requests where payloads using specific character encoding schemes via the Content-Type or Content-Transfer-Encoding multipart MIME header fields could bypass web application firewall detection. The vulnerability impacted legacy CRS versions 3.0.x and 3.1.x, as well as versions 3.2.1 and 3.3.2 (Core Rule Set).

The vulnerability allows attackers to submit payloads that use character encoding schemes through Content-Type or deprecated Content-Transfer-Encoding multipart MIME header fields that bypass inspection by the web application firewall engine and rule set. The CVSS v3.1 base score is 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) according to NVD assessment, while the Swiss Government Common Vulnerability Program rated it as 7.3 HIGH (NVD).

When exploited, the vulnerability allows multipart payloads to bypass detection completely. Any backend system that supports these encoding schemes could potentially be exploited, as the WAF would fail to inspect the encoded content. This creates a significant security gap where malicious content could be transmitted without detection (Core Rule Set).

The vulnerability requires no special privileges or user interaction to exploit, making it highly exploitable. The attack can be performed remotely by sending specially crafted HTTP requests with specific MIME header fields. The vulnerability was discovered during the Intigriti 1337UP0522 WAF Promotion Event by security researcher @terjanq (Jan Gora) (Core Rule Set).

Users and integrators are advised to upgrade to CRS versions 3.2.2 and 3.3.3 or later. Additionally, the mitigation requires installation of ModSecurity version 2.9.6 or 3.0.8 or later. Without the latest ModSecurity version, the vulnerability cannot be mitigated, and ModSecurity will refuse to start with error message 'Error creating rule: Unknown variable: MULTIPART_PART_HEADERS'. As a temporary workaround, users can disable/remove the rule file REQUEST-922-MULTIPART-ATTACK.conf, though this is not recommended as it leaves the system vulnerable (Core Rule Set, Debian LTS).