CVE-2007-1359

ModSecurity 2.1.0 and earlier ASCII 0x00 in POST data bypasses rules

• CVSS 6.8
• CWE-20: Improper Input Validation
• Input Validation and Sanitization
• Remote

Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ (0x00) byte, which mod_security treats as a terminator even though it is still processed as normal data by some HTTP parsers including PHP 5.2.0, and possibly parsers in Perl, and Python.

CVE

CVE-2007-1359

CWE

CWE-20: Improper Input Validation

CVSS base score

6.8

Published

2007-03-08

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update ModSecurity to version 2.1.1 or higher.

from flask import Flask, request

app = Flask(__name__)

@app.route('/submit', methods=['POST'])
def submit():
    form_data = request.form.to_dict()
    
    print("Received data:", form_data)

    return "Data processed successfully", 200

if __name__ == '__main__':
    app.run()

from flask import Flask, request

app = Flask(__name__)

@app.route('/submit', methods=['POST'])
def submit():

    raw_data = request.data

    if b'\x00' in raw_data:
        return "Invalid input: Null byte detected", 400

    form_data = request.form.to_dict()

    return "Data processed successfully", 200

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve20071359,
  title        = {{ModSecurity 2.1.0 and earlier ASCII 0x00 in POST data bypasses rules}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2007},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2007-1359},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2007-1359/}}
}