OWASP Core Rule Set Multipart Request Processing Vulnerability in Rule 922110

A vulnerability exists in the OWASP Core Rule Set (CRS) versions prior to 4.22.0 and 3.3.8, specifically within rule 922110. The issue arises when processing multipart requests that contain multiple parts. During the evaluation, the capture variables used to store header information are overwritten with each part, leaving only the last value available for subsequent rule checks. This behavior can cause malicious charset information in earlier parts to be ignored if a later part contains a legitimate charset. The vulnerability can be exploited by crafting a multipart request that includes harmful charset data in one part and legitimate data in another, bypassing the intended security checks.

Impact

Exploitation of this vulnerability can lead to a failure in properly validating multipart request headers, allowing malicious charsets to be overlooked. This could potentially be exploited to evade security rules that monitor for harmful content, especially in scenarios where the charsets could be used to manipulate or disrupt application behavior.

Reproduction

The vulnerability can be reproduced by sending a multipart request with at least two parts. The first part should include a malicious charset, such as 'utf-7', while the second part contains a legitimate charset, like 'utf-8'. Due to the way the rule processes the headers, the malicious charset in the first part will be ignored, and the request will pass through without being blocked, even though it should have been.

Remediation

Users can upgrade to OWASP Core Rule Set version 4.22.0 or 3.3.8 to address this vulnerability.