ModSecurity PCRE2 Regex Match Limit Bypass via @rxGlobal

Executive Summary

This vulnerability affects ModSecurity versions 3.0.5 to 3.0.17. It involves the @rxGlobal operator in PCRE2 regex matching. When attacker-controlled input exhausts the SecPcreMatchLimit setting, the system incorrectly treats match-limit errors as successful matches instead of failures. This creates a fail-open condition where malicious requests bypass WAF rules that should block them.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your ModSecurity version is between 3.0.5 and 3.0.16. Run 'modsecurity -v' to verify the version. Inspect WAF logs for requests triggering SecPcreMatchLimit exhaustion. Look for rules using @rxGlobal with MSC_PCRE_LIMITS_EXCEEDED indicators failing to block requests.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated remote attackers could exploit this to bypass ModSecurity WAF rules. If your system uses @rxGlobal with PCRE2 and relies on MSC_PCRE_LIMITS_EXCEEDED for blocking, malicious requests may pass through undetected. This could allow unauthorized access or attacks on your web application.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ModSecurity to version 3.0.17 or later immediately. Update your WAF rules to avoid relying solely on MSC_PCRE_LIMITS_EXCEEDED for blocking. Review and adjust SecPcreMatchLimit settings to prevent exhaustion. Monitor logs for suspicious patterns indicating bypass attempts.

Useful 0 Not Useful 0