CVE-2025-54571: 
ModSecurity vulnerability analysis and mitigation

CVE-2025-54571 is a vulnerability in OWASP ModSecurity (mod_security2) versions 2.9.11 and below that allows an attacker to override the HTTP response's Content-Type header, enabling cross-site scripting (XSS) attacks and arbitrary script source code disclosure. The vulnerability was disclosed on August 5–6, 2025, and affects all ModSecurity 2.x releases from 2.0.0 up to (but not including) 2.9.12. It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an unchecked return value (CWE-252) in mod_security2.c during the ap_hook_fixup phase (hook_request_late). When read_request_body() returns AP_FILTER_ERROR (mapped internally to return code -3), ModSecurity fails to handle this case in its switch statement, allowing request processing to continue and causing Apache HTTP Server to emit two HTTP responses. Apache places an error message in the response brigade and sets the Content-Type to text/html, which an attacker can leverage to override the intended Content-Type of the response. This was originally demonstrated by Max Dmitriev at ZeroNights 2021 and later confirmed exploitable in the latest mod_security2 by triggering AP_FILTER_ERROR via a crafted request with conflicting Transfer-Encoding: chunked and Content-Length headers (e.g., a negative chunk size). The fix adds proper handling for the -3 return code and refactors read_request_body() to return standard HTTP status codes rather than custom negative integers (GitHub Advisory, GitHub Issue, Fix Commit).

Successful exploitation allows an unauthenticated network attacker to override the HTTP response Content-Type header on Apache HTTP Server deployments running mod_security2. This can result in reflected or stored XSS attacks executed in the victim's browser (e.g., by causing an image file to be served as text/html), as well as disclosure of server-side script source code that the WAF is intended to protect. The vulnerability undermines the security posture of the WAF itself, potentially exposing sensitive application logic and enabling session hijacking or credential theft via XSS (GitHub Advisory).

Proof-of-concept exploit details are publicly available via the GitHub issue tracker and the security advisory, including a specific HTTP request payload that triggers the double-response condition (GitHub Issue, GitHub Advisory). As of the time of disclosure, there is no evidence of in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.04% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Discovery credit goes to Orange Tsai (@orange_8361) of DEVCORE Research Team.

1. Reconnaissance: Identify Apache HTTP Server deployments with mod_security2 (versions ≤ 2.9.11) enabled, using banner grabbing or service fingerprinting tools such as nmap or curl -I.
2. Craft malicious request: Construct an HTTP request with conflicting Transfer-Encoding: chunked and Content-Length headers, and include a malformed (e.g., negative) chunk size to trigger AP_FILTER_ERROR in Apache's input filter chain:

GET /target.php HTTP/1.1
Host: <target>
Transfer-Encoding: chunked
Content-Length: 13

-2
AA
0

3. Trigger double response: ModSecurity's unhandled -3 return code allows processing to continue, causing Apache to emit two HTTP responses — the error response (with Content-Type: text/html) followed by the actual resource response.
4. Override Content-Type: The attacker's crafted request causes the server to serve a resource (e.g., an image or script file) with Content-Type: text/html, overriding the intended MIME type.
5. Achieve XSS or source disclosure: By targeting a file containing script-like content (e.g., a PHP file or an image with embedded HTML/JS), the browser interprets the response as HTML and executes any embedded scripts, achieving XSS. Alternatively, source code of protected scripts may be disclosed to the attacker (GitHub Advisory, GitHub Issue).

• Network: HTTP requests to the server containing both Transfer-Encoding: chunked and Content-Length headers with malformed (e.g., negative or non-numeric) chunk sizes; double HTTP responses observed in traffic captures for a single request.
• Logs: Apache access logs showing requests with conflicting transfer encoding headers resulting in 400 Bad Request responses immediately followed by a 200 OK for the same connection; ModSecurity audit log entries (modsec_audit.log) showing AP_FILTER_ERROR or unexpected request body read errors.
• Logs: Apache error logs containing messages such as Error reading request body: HTTP Error 413 or filter error for requests that also produce a successful response.
• Network: Responses from the server with unexpected Content-Type: text/html for resources that should be served as images, scripts, or other non-HTML MIME types.

Upgrade ModSecurity (mod_security2) to version 2.9.12 or later, which properly handles the AP_FILTER_ERROR return code and prevents the double-response condition. The OWASP ModSecurity project has confirmed there are no known workarounds for this issue — patching is the only remediation. Oracle has also addressed this vulnerability in its January 2026 and April 2026 Critical Patch Updates for affected Oracle products. Linux distribution vendors including Debian, Amazon Linux 2, and SUSE have released updated packages (GitHub Advisory, Oracle CPU Jan 2026).

The vulnerability was credited to Orange Tsai (@orange_8361) of DEVCORE Research Team, a well-known security researcher. The issue was originally raised in a GitHub issue in February 2021 and was presented by Max Dmitriev at ZeroNights 2021, but the underlying root cause in ModSecurity was not fully addressed until the 2025 disclosure. Multiple Linux distribution vendors (Debian, SUSE, Amazon Linux 2) issued security advisories and updated packages following the disclosure. The ModSecurity project published a detailed advisory explaining the technical root cause and fix (GitHub Advisory, GitHub Issue).