ModSecurity Patches Two High-Severity Flaws Enabling WAF Bypass and RCE
ModSecurity, a widely-used open-source Web Application Firewall, has released patches for two critical vulnerabilities that could allow attackers to bypass security checks and achieve remote code execution.
ModSecurity, an open-source Web Application Firewall (WAF) integral to the security of web servers running Apache, IIS, and Nginx, has addressed two significant vulnerabilities that could undermine its protective capabilities. The flaws, detailed in advisories from maintainer airween, pose risks of malicious file uploads and potential remote code execution (RCE).
The first vulnerability, identified as CVE-2026-104269 (GHSA-5pww-8rfg-9crf), affects ModSecurity versions 3.0.0 and later. It stems from a discrepancy in how ModSecurity's multipart parser handles RFC 2231, a standard for encoding values in HTTP headers, compared to many application frameworks. Attackers can exploit this by submitting a request with both a legitimate filename (e.g., safe.jpg) and an encoded, malicious filename (e.g., shell.php). While ModSecurity's Core Rule Set might deem the file safe based on the .jpg extension, backend frameworks in languages like Go, Python, Node.js, and Java Spring may interpret the encoded name, leading to the execution of malicious scripts if the uploaded file is served by the web server. Researchers 0xkalawy and ZeyadZonkorany discovered this issue, with B0YK4 coordinating the report.
The second flaw, CVE-2026-73857 (GHSA-jx3r-phvx-2jmj), discovered by Tobias Klein, allows unauthenticated remote attackers to trigger an uninitialized pointer dereference with a specially crafted request. This can lead to a denial-of-service condition through a crash, a memory leak, or potentially remote code execution by redirecting program flow. This vulnerability is particularly concerning as it targets the SecParseXmlIntoArgs function, which is enabled by default in some configurations. The affected versions are 3.0.15, 3.0.16, and the current master branch of v3. ModSecurity v2 and earlier 3.0.x releases are not impacted.
While the advisories indicate that version 3.0.17 is intended to contain a fix for CVE-2026-73857, the advisory text notes that a patch is "not yet" available, urging administrators to verify the official project page for the confirmed release of the fix. For CVE-2026-104269, no specific patch has been released, leaving administrators reliant on workarounds. The advisory suggests disabling SecParseXmlIntoArgs for the XML flaw, which is the default setting, and implementing application-level validation for file uploads to mitigate the bypass vulnerability.
Beyond the immediate advisories, best practices for mitigating the file upload vulnerability include having applications ignore client-provided filenames, generating safe filenames internally, blocking script extensions, and storing all uploads outside the web server's document root. These measures, while not directly part of the ModSecurity fix, are crucial for robust security against such attacks.
This incident highlights ongoing challenges in securing web applications, particularly concerning the parsing of complex request components like file uploads and XML data. ModSecurity, despite its widespread use and effectiveness, has faced scrutiny for recent bypass vulnerabilities, underscoring the continuous need for vigilance and prompt patching by both WAF vendors and application developers.
The disclosure of these vulnerabilities serves as a critical reminder for organizations to maintain up-to-date security configurations for their WAFs and to implement defense-in-depth strategies that include application-level security controls. The potential for RCE, even with specific configuration requirements or parser mismatches, necessitates a proactive approach to vulnerability management.