CVE-2024-1019

What it actually does

ModSecurity 3.0.0-3.0.11 decodes percent-encoded characters in request URLs before separating the path component from the query string, creating an impedance mismatch with RFC-compliant back-end applications that allows path-based attack payloads to bypass WAF inspection rules.

Why it matters to the business

Organizations using affected ModSecurity versions face increased risk of successful web attacks reaching back-end systems that rely on URL paths for query construction, potentially exposing applications to unauthorized data access or manipulation until upgraded.

How an attack unfolds

An attacker crafts a request URL containing a percent-encoded payload in the path component; ModSecurity decodes the characters before path/query separation, causing WAF rules to miss the hidden payload while the back-end processes the decoded path and executes the attack.

How to fix it

Upgrade owasp-modsecurity/modsecurity to the fixed commit 5f44383236b94ef8066529861d0b4d603f9b3bcb (equivalent to version 3.0.12). The ModSecurity v2 line is unaffected and requires no change.

How to confirm the fix worked

Verify the installed ModSecurity version or commit hash against the fixed commit; test with crafted percent-encoded path requests to confirm WAF rules now correctly inspect the decoded path component.

Typical attack path

1. Identify target application using URL path components for back-end queries
2. Craft request URL embedding attack payload via percent-encoding in the path segment
3. Send the request through the ModSecurity-protected endpoint
4. WAF fails to match the payload due to premature decoding and component separation
5. Back-end application processes the decoded path and executes the attack

How to detect it

Review web server and ModSecurity audit logs for requests containing percent-encoded sequences in the path component followed by backend query anomalies; correlate with application logs showing unexpected path-derived query execution.

What your security team should do

• Immediately upgrade all ModSecurity 3.x instances to the fixed commit 5f44383236b94ef8066529861d0b4d603f9b3bcb
• Audit WAF rule sets that inspect URL paths for any reliance on pre-decoding behavior
• Review back-end code that constructs queries from request URL paths for additional input validation
• Monitor for increased blocked requests after upgrade to validate improved detection