OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal\/auditlog\/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When SecAuditLogFormat Native is enabled, injected line breaks can create forged lines inside a transaction record. An attacker who controls request or response body, header, error-message, or matched-rule data can inject carriage returns and line feeds that appear as forged audit lines within a transaction record. The forged content can mislead operators and line-oriented SIEM processing, although the unpredictable transaction boundary prevents straightforward impersonation of a separate complete session. This issue is fixed in version 3.8.0.<\/p>\n","protected":false},"excerpt":{"rendered":"
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal\/auditlog\/formats.go writes attacker-influenced <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-36384","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/36384","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=36384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=36384"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=36384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}