ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with     nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests.
    Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes     for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly     vulnerable: the affected versions include 2.8.0 through 2.9.4. (CVE-2021-42717)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0269-1 advisory.

  - ** DISPUTED ** Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request.
    NOTE: The discoverer reports Trustwave has signaled they are disputing our claims. The CVE suggests that     there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of     Service condition. The vendor does not consider this as a security issue because1) there is no default     configuration issue here. An attacker would need to know that a rule using a potentially problematic     regular expression was in place, 2) the attacker would need to know the basic nature of the regular     expression itself to exploit any resource issues. It's well known that regular expression usage can be     taxing on system resources regardless of the use case. It is up to the administrator to decide on when it     is appropriate to trade resources for potential security benefit. (CVE-2020-15598)

  - ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with     nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests.
    Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes     for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly     vulnerable: the affected versions include 2.8.0 through 2.9.4. (CVE-2021-42717)

  - Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and     unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.
    (CVE-2023-28882)

  - Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. (CVE-2023-38285)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0257-1 advisory.

  - ** DISPUTED ** Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request.
    NOTE: The discoverer reports Trustwave has signaled they are disputing our claims. The CVE suggests that     there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of     Service condition. The vendor does not consider this as a security issue because1) there is no default     configuration issue here. An attacker would need to know that a rule using a potentially problematic     regular expression was in place, 2) the attacker would need to know the basic nature of the regular     expression itself to exploit any resource issues. It's well known that regular expression usage can be     taxing on system resources regardless of the use case. It is up to the administrator to decide on when it     is appropriate to trade resources for potential security benefit. (CVE-2020-15598)

  - ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with     nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests.
    Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes     for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly     vulnerable: the affected versions include 2.8.0 through 2.9.4. (CVE-2021-42717)

  - Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and     unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.
    (CVE-2023-28882)

  - Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. (CVE-2023-38285)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6370-1 advisory.

    It was discovered that ModSecurity incorrectly handled certain nested JSON objects. An attacker could     possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu     18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42717)

    It was discovered that ModSecurity incorrectly handled certain HTTP multipart requests. A remote attacker     could possibly use this issue to bypass ModSecurity restrictions. (CVE-2022-48279)

    It was discovered that ModSecurity incorrectly handled certain file uploads. A remote attacker could     possibly use this issue to cause a buffer overflow and a firewall failure. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-24021)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the Jan 2023 CPU advisory.

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Centralized Thirdparty     Jars (Expat)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of     this vulnerability can result in takeover of Oracle HTTP Server. (CVE-2022-25236)

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: SSL Module (Apache HTTP     Server)). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful attacks of     this vulnerability can result in takeover of Oracle HTTP Server. (CVE-2022-31813)     

  - Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: SSL Module (OpenSSL)).     The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful attacks of this vulnerability     can result in takeover of Oracle HTTP Server. (CVE-2022-2274)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-3031 advisory.

  - ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with     nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests.
    Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes     for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly     vulnerable: the affected versions include 2.8.0 through 2.9.4. (CVE-2021-42717)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the mod_security package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with     nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests.
    Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes     for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly     vulnerable: the affected versions include 2.8.0 through 2.9.4. (CVE-2021-42717)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-5023 advisory.

    It was discovered that modsecurity-apache, an Apache module to tighten the Web application security, does     not properly handles excessively nested JSON objects, which could result in denial of service. The update     introduces a new SecRequestBodyJsonDepthLimit option to limit the maximum request body JSON parsing depth     which ModSecurity will accept (defaults to 10000). For the oldstable distribution (buster), this problem     has been fixed in version 2.9.3-1+deb10u1. For the stable distribution (bullseye), this problem has been     fixed in version 2.9.3-3+deb11u1. We recommend that you upgrade your modsecurity-apache packages. For the     detailed security status of modsecurity-apache please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/modsecurity-apache

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
224272	Linux Distros Unpatched Vulnerability : CVE-2021-42717	Nessus	Misc.	Local	high
181919	openSUSE 15 Security Update : modsecurity (openSUSE-SU-2023:0269-1)	Nessus	SuSE Local Security Checks	Local	high
181862	openSUSE 15 Security Update : modsecurity (openSUSE-SU-2023:0257-1)	Nessus	SuSE Local Security Checks	Local	high
181427	Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 ESM : ModSecurity vulnerabilities (USN-6370-1)	Nessus	Ubuntu Local Security Checks	Local	high
170268	Oracle HTTP Server (Jan 2023 CPU)	Nessus	Web Servers	Local	critical
161656	Debian DLA-3031-1 : modsecurity-apache - LTS security update	Nessus	Debian Local Security Checks	Local	high
159260	EulerOS 2.0 SP8 : mod_security (EulerOS-SA-2022-1355)	Nessus	Huawei Local Security Checks	Local	high
159083	EulerOS 2.0 SP5 : mod_security (EulerOS-SA-2022-1332)	Nessus	Huawei Local Security Checks	Local	high
156186	Debian DSA-5023-1 : modsecurity-apache - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2021-42717

high

Tenable Plugins

high

high

high

high

critical

high

high

high

high