CVE-2019-11390 : What You Need to Know

A vulnerability has been identified in the OWASP ModSecurity Core Rule Set (CRS) version 3.1.0 that could potentially enable remote attackers to launch a ReDoS attack. The software maintainer disputes this classification as it cannot be exploited through ModSecurity.

Understanding CVE-2019-11390

This CVE involves a disputed vulnerability in the OWASP ModSecurity Core Rule Set (CRS) version 3.1.0.

What is CVE-2019-11390?

The vulnerability in the file "/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf" allows remote attackers to trigger a ReDoS attack by inputting a specially crafted string starting with "set_error_handler#" and containing nested repetition operators.

The Impact of CVE-2019-11390

The software maintainer argues that this issue cannot be exploited through ModSecurity, potentially reducing the severity of the vulnerability.

Technical Details of CVE-2019-11390

This section provides more technical insights into the CVE.

Vulnerability Description

The vulnerability in the OWASP ModSecurity CRS version 3.1.0 allows for a ReDoS attack through a specific file, potentially leading to a denial of service.

Affected Systems and Versions

OWASP ModSecurity Core Rule Set (CRS) version 3.1.0

Exploitation Mechanism

Attackers can exploit the vulnerability by inputting a crafted string with specific characteristics.

Mitigation and Prevention

Protecting systems from CVE-2019-11390 requires immediate actions and long-term security practices.

Immediate Steps to Take

Monitor for any unusual activities related to the vulnerability.
Consider alternative security measures if the vulnerability poses a significant risk.

Long-Term Security Practices

Regularly update security software and patches to prevent potential exploits.
Conduct thorough security assessments to identify and address vulnerabilities.
Educate users and administrators on safe practices to mitigate risks.
Stay informed about security developments and updates in the OWASP ModSecurity CRS.

Patching and Updates

Stay informed about any official patches or updates released by OWASP ModSecurity CRS to address this vulnerability.