CVE-2024-1019: OWASP ModSecurity Auth Bypass Vulnerability

CVE-2024-1019 Overview

CVE-2024-1019 is a Web Application Firewall (WAF) bypass affecting ModSecurity v3 (libModSecurity) versions 3.0.0 through 3.0.11. The vulnerability stems from incorrect URL parsing order: ModSecurity v3 decodes percent-encoded characters in request URLs before separating the path component from the query string. This creates an impedance mismatch with RFC-compliant back-end applications. Attackers can hide payloads inside the URL path that bypass WAF inspection rules but still reach the back-end. Applications that use the URL path to construct database queries or other commands are particularly exposed. The ModSecurity v2 release line is not affected.

Critical Impact
Attackers can smuggle injection payloads past ModSecurity v3 rule sets by encoding query separators in the URL path, defeating WAF protections without authentication.

Affected Products

OWASP ModSecurity 3.0.0 through 3.0.11
libModSecurity 3.0.0 through 3.0.11
Fedora distributions shipping affected mod_security packages

Discovery Timeline

2024-01-30 - CVE-2024-1019 published to NVD
2025-07-03 - Last updated in NVD database

Technical Details for CVE-2024-1019

Vulnerability Analysis

CVE-2024-1019 is an input validation flaw [CWE-20] in the URL parsing pipeline of libModSecurity 3. When a request arrives, ModSecurity v3 applies percent-decoding to the entire request URL before splitting it on the ? delimiter that separates path from query string. RFC 3986-compliant back-end servers perform these operations in the opposite order: they first split on ?, then decode each component.

This ordering inconsistency lets an attacker place an encoded %3F (the percent-encoded ?) inside the URL path. ModSecurity decodes the %3F first, treating everything after it as the query string and inspecting only the truncated path. The back-end, however, treats the %3F as a literal character in the path and processes the full payload. WAF rules that scan the path for SQL injection, command injection, or path traversal patterns never see the malicious content.

Root Cause

The root cause is incorrect URL component parsing order inside libModSecurity. Decoding precedes delimiter splitting, violating RFC 3986 expectations and creating a parser differential between the WAF and the protected application.

Attack Vector

An unauthenticated remote attacker crafts a request URL containing percent-encoded query delimiters or other reserved characters within the path segment. The WAF inspects a sanitized view while the back-end receives the raw, exploit-bearing path. Applications that construct SQL queries, shell commands, or file paths from URL path segments are at highest risk. See the OWASP ModSecurity CVE Analysis for additional technical context.

Detection Methods for CVE-2024-1019

Indicators of Compromise

Inbound HTTP requests containing percent-encoded delimiters such as %3F, %23, or %26 embedded within the URL path component before any literal ?.
Back-end application logs showing query strings or parameters that are not present in the corresponding WAF access logs.
WAF audit logs reporting REQUEST_URI or REQUEST_FILENAME values that differ materially from those logged by the upstream web server.

Detection Strategies

Compare ModSecurity audit log URLs with the raw URLs recorded by the reverse proxy or origin server to identify parser-differential discrepancies.
Hunt for known injection signatures (SQL keywords, shell metacharacters, traversal sequences) appearing in back-end logs but absent from WAF identification events.
Deploy custom ModSecurity rules that flag requests containing encoded query or fragment delimiters inside path segments.

Monitoring Recommendations

Enable ModSecurity full audit logging on a sample of traffic and correlate it with web server access logs in a centralized analytics platform.
Alert on anomalously high counts of %3F, %23, or %2F sequences appearing before the first literal ? in request URLs.
Track the running ModSecurity version across the fleet and alert when hosts report a version earlier than 3.0.12.

How to Mitigate CVE-2024-1019

Immediate Actions Required

Upgrade libModSecurity and all integrations to version 3.0.12 or later on every host that processes inbound HTTP traffic.
Inventory all reverse proxies, ingress controllers, and web servers using ModSecurity v3 and prioritize internet-facing instances first.
Review WAF rule sets, including the OWASP Core Rule Set (CRS), and confirm they continue to identify path-based payloads after patching.

Patch Information

The ModSecurity maintainers fixed CVE-2024-1019 in libModSecurity 3.0.12. Fedora has published updated packages through the Fedora Package Announcement and a second Fedora Package Announcement. Refer to the OWASP ModSecurity advisory for upstream release notes.

Workarounds

Add a pre-processing rule that rejects requests containing %3F, %23, or other percent-encoded reserved characters within the URL path segment.
Normalize and re-encode URLs at the edge proxy before passing them to back-end applications so both parsers operate on identical input.
Apply strict server-side input validation to any back-end code that constructs queries or file operations from URL path components.

bash

# Example ModSecurity rule to block encoded query delimiters in the URL path
SecRule REQUEST_URI "@rx %(?:3[Ff]|23|26)" \
    "id:1900001,phase:1,deny,status:400,log,\
    msg:'Encoded delimiter detected in URL path (CVE-2024-1019 mitigation)'"