CVE-2023-38199
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
ModSecurity Core Rule Set up to version 3.3.4 does not detect multiple Content-Type request headers on some platforms, potentially allowing attackers to bypass a WAF with a crafted payload. This issue arises when the web application relies solely on the last Content-Type header.
Risk Assessment
Organizations may be vulnerable to attacks that exploit Content-Type confusion, potentially leading to unauthorized access to the backend application.
Recommendation
It is recommended to update the ModSecurity Core Rule Set to the latest version and test the application for handling multiple Content-Type headers.
Original NVD description (English source)
coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This might allow attackers to bypass a WAF with a crafted payload, aka "Content-Type confusion" between the WAF and the backend application. This occurs when the web application relies on only the last Content-Type header. Other platforms may reject the additional Content-Type header or merge conflicting headers, leading to detection as a malformed header.