Coraza WAF Request Body Inspection Bypass via Content-Type Manipulation

Executive Summary

Coraza WAF versions 3.0.4 to 3.8.0 have a flaw where URL-encoded form bodies with Content-Type headers containing media-type parameters like charset=UTF-8 bypass body inspection. The system compares the entire Content-Type value exactly, so it fails to parse bodies with parameters, leaving ARGS_POST and REQUEST_BODY empty while the backend processes the payload. Attackers can exploit this to evade security rules.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect network traffic for requests with Content-Type headers like application/x-www-form-urlencoded; charset=UTF-8. Check if Coraza versions 3.0.4 to 3.8.0 are in use. Monitor for ARGS_POST and REQUEST_BODY being empty despite payloads being processed by the backend.

• Use curl to send a test request with a URL-encoded body and modified Content-Type header to see if Coraza processes it correctly.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers can send specially crafted requests to bypass WAF rules, allowing malicious form data to reach the backend undetected. This could lead to unauthorized actions, data theft, or further exploitation of backend systems if custom security rules are evaded.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may compromise data integrity and security controls required by GDPR and HIPAA. Bypassing WAF rules could lead to unauthorized data access or processing, violating compliance requirements for protecting sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Coraza to version 3.8.1 or later to address the vulnerability. If upgrading is not immediately possible, implement additional safeguards such as custom rules to validate request bodies or deploy a WAF rule like OWASP CRS 901340.

• Monitor incoming requests for Content-Type headers with media-type parameters and block or log such requests as suspicious.

Useful 0 Not Useful 0