Skip to content

Blog post on releases 4.6.0 and 3.3.6 #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Aug 29, 2024
Merged

Blog post on releases 4.6.0 and 3.3.6 #144

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
77403a7
Blog post on releases 4.6.0 and 3.3.6
amonachesi Aug 29, 2024
f9f2fa3
Update 2024-08-29-crs-versions-4-6-0-and-3-3-6-have-been-released.md
amonachesi Aug 29, 2024
a8ba2df
Update 2024-08-29-crs-versions-4-6-0-and-3-3-6-have-been-released.md
amonachesi Aug 29, 2024
ba72c77
Update 2024-08-29-crs-versions-4-6-0-and-3-3-6-have-been-released.md
amonachesi Aug 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions content/blog/2024-08-29-crs-versions-4-6-0-and-3-3-6-have-been-released.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
---
title: CRS versions 4.6.0 and 3.3.6 have been released
date: 2024-08-29
author: amonachesi
categories:
- Blog
---
We have recently released version [4.6.0](https://github.com/coreruleset/coreruleset/releases/tag/v4.6.0) for CRS 4, fixing a serious problem. As this problem affects CRS 3 as well, we also did a backport release for v3. ([3.3.6](https://github.com/coreruleset/coreruleset/releases/tag/v3.3.6)). All users are requested to update to the new releases.

The new releases tackle two multipart file upload bypass methods that were reported by [@luelueking](https://github.com/luelueking):

1. Wrapping the Content-Disposition with non-printable characters like \x0e (e.g. “%0e Content-Disposition %0e”) may allow the header to go undetected by the WAF engine as it may not be correctly parsed.
2. Inserting the character \ in a filename (e.g. “1.j\s\p”) may let the filename go undetected.

The fixes introduced in both versions are the same:

1. We have added a new rule 922130 which checks if any multipart header contains a non-ASCII character (v4: [#3796](https://github.com/coreruleset/coreruleset/pull/3796); v3: [#3797](https://github.com/coreruleset/coreruleset/pull/3797)).
2. The use of backslashes in file names is prevented (v4: [#3799](https://github.com/coreruleset/coreruleset/pull/3799), v3: [#3800](https://github.com/coreruleset/coreruleset/pull/3800)).

Thanks to @luelueking for bringing this to our attention.

Release 4.6.0 contains other features and fixes like

- a rule to detect bash tilde expansions by [@Xhoenix](https://github.com/Xhoenix) ([#3765](https://github.com/coreruleset/coreruleset/pull/3765))
- the addition of the .pem format to the restricted file extensions by [@EsadCetiner](https://github.com/EsadCetiner) ([#3789](https://github.com/coreruleset/coreruleset/pull/3789))
- the removal of unnecessary chain rule and capture in rule 921180 by [@EsadCetiner](https://github.com/EsadCetiner) ([#3787](https://github.com/coreruleset/coreruleset/pull/3787))
- a fix for rule 942160 by checking against REQUEST_FILENAME by [@mat1010](https://github.com/mat1010) ([#3782](https://github.com/coreruleset/coreruleset/pull/3782))
- an update of rule 932270's version variable by [@airween](https://github.com/airween) ([#3786](https://github.com/coreruleset/coreruleset/pull/3786))