OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPART_STRICT_ERROR. A remote attacker can submit a truncated multipart body that produces io.ErrUnexpectedEOF, causing parsing to stop without raising the strict-error signal used by the recommended defensive rule.
Rules 200002 and 200003 do not fire, allowing multipart parser-disagreement payloads to reach a backend that interprets the truncated body differently. This issue is fixed in version 3.8.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
corazawaf:coraza
References 3
https://github.com/corazawaf/coraza/security/advisories/GHSA-r3rm-qphw-hh76
https://github.com/corazawaf/coraza/security/advisories/GHSA-r3rm-qphw-hh76
https://github.com/corazawaf/coraza/commit/f94c81bec209f658120c418448d0590a549b…
https://github.com/corazawaf/coraza/commit/f94c81bec209f658120c418448d0590a549b71df
https://github.com/corazawaf/coraza/releases/tag/v3.8.0
https://github.com/corazawaf/coraza/releases/tag/v3.8.0