CVE-2025-29914: OWASP Coraza WAF Auth Bypass Vulnerability

CVE-2025-29914 Overview

CVE-2025-29914 affects OWASP Coraza, a Go-based ModSecurity-compatible web application firewall (WAF) library. Versions prior to 3.3.3 mishandle request URIs that begin with a double slash (//). When Coraza receives such a URI, it populates the REQUEST_FILENAME transaction variable with an incorrect value, stripping the first path segment. Attackers can craft requests like //bar/uploads/foo.php?a=b to cause Coraza to evaluate REQUEST_FILENAME as /uploads/foo.php, bypassing rules that match on path patterns. This weakness maps to [CWE-706: Use of Incorrectly-Resolved Name or Reference].

Critical Impact
Attackers can bypass WAF rules that inspect REQUEST_FILENAME, allowing malicious requests to reach protected backend applications undetected.

Affected Products

OWASP Coraza WAF versions prior to 3.3.3
Applications and gateways embedding the Coraza library
ModSecurity rule sets (e.g., OWASP CRS) deployed on vulnerable Coraza builds

Discovery Timeline

2025-03-20 - CVE-2025-29914 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29914

Vulnerability Analysis

Coraza parses the incoming request URI to populate ModSecurity-compatible transaction variables, including REQUEST_FILENAME. The pre-3.3.3 implementation uses Go's url.Parse function, which accepts URIs with leading // as relative references containing an authority component. As a result, the first path segment after // is interpreted as a host, not part of the path. Coraza then stores only the remaining path in REQUEST_FILENAME. WAF rules matching on filename patterns (for example, blocking /bar/uploads/*.php) never see the original path and fail to trigger, letting the request pass to the origin server.

Root Cause

The root cause is improper URI parsing inside internal/corazawaf/transaction.go. The function called url.Parse, which treats network-path references (//host/path) as valid and separates them into host and path components. The fix replaces the call with url.ParseRequestURI, which requires an absolute URI or absolute path and rejects the ambiguous network-path reference form used in HTTP requests.

Attack Vector

An unauthenticated remote attacker sends an HTTP request whose request-target begins with //. Any Coraza-protected endpoint reachable over the network is exposed. The attacker chains this bypass with a payload targeting a filename-based rule, for example a PHP upload path or admin endpoint that would otherwise be blocked. Exploitation requires no authentication and no user interaction, but the attacker must know which rules rely on REQUEST_FILENAME to weaponize the bypass reliably.

// Security patch in internal/corazawaf/transaction.go
// Source: https://github.com/corazawaf/coraza/commit/4722c9ad0d502abd56b8d6733c6b47eb4111742d

		uri = uri[:in]
	}
	path := ""
-	parsedURL, err := url.Parse(uri)
+	parsedURL, err := url.ParseRequestURI(uri)
	query := ""
	if err != nil {
		tx.variables.urlencodedError.Set(err.Error())

The patch switches from url.Parse to url.ParseRequestURI, which enforces stricter validation and prevents leading // from being interpreted as an authority component.

Detection Methods for CVE-2025-29914

Indicators of Compromise

HTTP request lines with request-targets beginning with //, such as GET //admin/config.php HTTP/1.1.
Access logs showing successful responses to paths that should match blocking WAF rules.
Coraza audit logs where REQUEST_FILENAME does not match the raw REQUEST_URI path prefix.

Detection Strategies

Compare the raw request-target in access logs against the REQUEST_FILENAME recorded by Coraza and alert on mismatches.
Deploy a pre-WAF normalization rule that flags or rewrites URIs beginning with // before Coraza evaluation.
Review WAF disruption metrics for unexpected drops in rule hits on filename-based signatures after upstream traffic changes.

Monitoring Recommendations

Ingest Coraza audit logs and reverse proxy access logs into a centralized analytics platform to correlate raw URI patterns with rule outcomes.
Track the version of the Coraza library across all gateways and alert on any instance running below 3.3.3.
Add synthetic probes that send //-prefixed requests to protected endpoints and verify the WAF blocks them.

How to Mitigate CVE-2025-29914

Immediate Actions Required

Upgrade OWASP Coraza to version 3.3.3 or later across every deployment that embeds the library.
Rebuild and redeploy downstream products (API gateways, ingress controllers, custom WAFs) that vendor Coraza as a dependency.
Audit existing ModSecurity/CRS rule sets for reliance on REQUEST_FILENAME and validate their behavior against //-prefixed inputs after upgrading.

Patch Information

The fix is delivered in Coraza 3.3.3 via commit 4722c9ad0d502abd56b8d6733c6b47eb4111742d, which replaces url.Parse with url.ParseRequestURI in internal/corazawaf/transaction.go. Full details are documented in the GitHub Security Advisory GHSA-q9f5-625g-xm39 and the GitHub commit.

Workarounds

Add an upstream normalization step (reverse proxy or ingress) that collapses repeated leading slashes before traffic reaches Coraza.
Deploy a custom Coraza rule that inspects REQUEST_URI_RAW for a // prefix and blocks or rewrites matching requests.
Restrict exposure of filename-sensitive endpoints with additional authentication controls until the upgrade is complete.

bash

# Example NGINX normalization to strip leading double slashes before Coraza
location / {
    rewrite ^//+(.*)$ /$1 last;
    # forward to Coraza-protected upstream
    proxy_pass http://backend;
}