CVE-2019-11387 : Vulnerability Insights and Analysis
Learn about CVE-2019-11387, a vulnerability in OWASP ModSecurity Core Rule Set (CRS) up to version 3.1.0 allowing denial of service attacks. Find out the impact, affected systems, and mitigation steps.
A vulnerability was found in the OWASP ModSecurity Core Rule Set (CRS) up to version 3.1.0, allowing a denial of service attack (ReDOS) through a specially crafted string. Learn more about the impact, technical details, and mitigation steps.
Understanding CVE-2019-11387
This CVE identifies a vulnerability in the OWASP ModSecurity Core Rule Set (CRS) up to version 3.1.0 that can be exploited for a denial of service attack.
What is CVE-2019-11387?
This vulnerability exists in the file /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf in OWASP ModSecurity CRS up to version 3.1.0, allowing remote attackers to trigger a denial of service attack by inputting a specifically crafted string with nested repetition operators.
The Impact of CVE-2019-11387
The vulnerability can be exploited by malicious users to cause a denial of service (ReDOS) on systems running the affected versions of OWASP ModSecurity CRS.
Technical Details of CVE-2019-11387
This section provides more in-depth technical insights into the vulnerability.
Vulnerability Description
The file /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf in OWASP ModSecurity CRS up to version 3.1.0 is susceptible to a denial of service attack (ReDOS) due to specially crafted input strings.
Affected Systems and Versions
- OWASP ModSecurity Core Rule Set (CRS) up to version 3.1.0
Exploitation Mechanism
- Attackers can exploit the vulnerability by entering a specifically crafted string with nested repetition operators.
Mitigation and Prevention
Protect your systems from CVE-2019-11387 with these mitigation strategies.
Immediate Steps to Take
- Update OWASP ModSecurity CRS to version 3.1.1 or later to patch the vulnerability.
- Monitor and filter user input to detect and block malicious strings.
Long-Term Security Practices
- Regularly update security software and rulesets to prevent known vulnerabilities.
- Implement input validation mechanisms to sanitize user input and prevent malicious payloads.
Patching and Updates
- Apply patches and updates provided by OWASP ModSecurity CRS to address the vulnerability and enhance system security.