CVE-2022-39957: 
ModSecurity vulnerability analysis and mitigation

The OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass vulnerability (CVE-2022-39957) discovered during the Intigriti 1337UP0522 WAF Promotion Event. The vulnerability was reported by Karel Knibbe (@Karel_Origin) and affects legacy CRS versions 3.0.x and 3.1.x, as well as versions 3.2.1 and 3.3.2 (CRS Blog).

The vulnerability allows a client to issue an HTTP Accept header field containing an optional charset parameter to receive the response in an encoded form. Depending on the charset, this response cannot be decoded by the web application firewall. This means a restricted resource that would normally be detected can bypass detection (NVD, CRS Blog).

When successfully exploited, this vulnerability allows attackers to bypass the web application firewall's response body inspection. A restricted resource that would ordinarily be detected can be accessed without triggering the WAF's detection mechanisms (Debian LTS).

Users and integrators are advised to upgrade to CRS versions 3.2.2/3.2.3 or 3.3.3/3.3.4 to address this vulnerability. The issue was fixed in these releases as part of a broader security update that addressed multiple vulnerabilities (CRS Blog, Debian LTS).