CVE-2024-1019
WAF bypass of the ModSecurity v3 release line
- Published
- Updated
- Reserved
- Assigned by
- NCSC.ch
Description
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string component. This results in an impedance mismatch versus RFC compliant back-end applications. The vulnerability hides an attack payload in the path component of the URL from WAF rules inspecting it. A back-end may be vulnerable if it uses the path component of request URLs to construct queries. Integrators and users are advised to upgrade to 3.0.12. The ModSecurity v2 release line is not affected by this vulnerability.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NCSC.chCNA (assigner) | 3.1 | High8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
| NVDNVD · Modified | 3.1 | High8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.69% · top 47% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.6.
Weakness
Affected products
OWASP ModSecurity · ModSecurity
- affected 3.0.0 – ≤ 3.0.11
What to do
Solution: Upgrade to ModSecurity 3.0.12.
Workaround: ModSecurity v3’s REQUEST_URI_RAW variable contains the full URI and is unaffected by the URL decoding step. It is therefore possible to use the REQUEST_URI_RAW variable to derive all other required variables correctly, including performing any required URL decoding.
References (3)
- https://owasp.org/www-project-modsecurity/tab_cves#cve-2024-1019-2024-01-30 (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/34KDQNZE2RS3CWFG5654LNHKXXDPIW5I/ (opens in a new tab)x_transferred
- https://lists.fedoraproject.org/archives/list/[email protected]/message/K6ZGABPJK2JPVH2JDFHZ5LQLWGONUH7V/ (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-1019)Record last updated .