Coraza Multipart Upload Filename Bypass via Charset Mismatch

Executive Summary

Coraza before 3.8.1 mishandles multipart upload filenames by relying on Go's mime.ParseMediaType, which ignores RFC 5987 filename* parameters with non-UTF-8 or non-US-ASCII charsets. Attackers can send a decoy filename with a manipulated charset like iso-8859-1 or omit the charset, causing FILES-based rules to miss the real filename. This lets malicious uploads bypass security checks and reach backends that honor the filename.

Useful 0 Not Useful 0

Detection Guidance

Check Coraza WAF version with: coraza --version. If version is below 3.8.1, the system is vulnerable. Inspect HTTP requests with multipart uploads for filename* parameters using non-UTF-8 or non-US-ASCII charsets. Monitor FILES-based rules for bypass attempts where filenames appear safe in Coraza but malicious in backend.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could upload malicious files disguised as safe files (e.g., safe.jpg) but received by the backend as dangerous files (e.g., shell.php). This bypasses security rules checking FILES variables, potentially leading to remote code execution or other attacks if the backend processes the malicious files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file uploads, potentially violating data integrity and access control requirements in GDPR and HIPAA. If malicious files are uploaded and processed, it may result in unauthorized data access or modification, triggering compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Coraza WAF to version 3.8.1 or later immediately. Review and update WAF rules to inspect MULTIPART_FILENAME variables instead of FILES. Block requests with filename* parameters using non-UTF-8 or non-US-ASCII charsets. Test backend applications for RFC 5987 filename handling compatibility.

Useful 0 Not Useful 0