CVE-2025-54571 Overview
CVE-2025-54571 affects ModSecurity, an open source cross-platform web application firewall (WAF) engine used with Apache, IIS, and Nginx. The vulnerability allows an attacker to override the HTTP response's Content-Type header. This behavior enables cross-site scripting (XSS) and arbitrary script source code disclosure in mod_security2. The issue affects versions 2.9.11 and below and is fixed in version 2.9.12. The vulnerability is tracked under [CWE-79] (XSS) and [CWE-252] (unchecked return value).
Critical Impact
Attackers can manipulate HTTP response Content-Type handling in ModSecurity, resulting in cross-site scripting and disclosure of server-side script source code.
Affected Products
- OWASP ModSecurity 2.9.11 and earlier
- Apache mod_security2 module
- Debian LTS ModSecurity packages
Discovery Timeline
- 2025-08-06 - CVE-2025-54571 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54571
Vulnerability Analysis
ModSecurity 2.9.11 and below fail to properly enforce the HTTP response Content-Type when specific processing conditions occur. An attacker can influence how the WAF handles the response, causing the wrong content type to be applied to returned data. When a browser interprets a response using an attacker-influenced content type, it may render HTML and JavaScript from data that should have been served as plain text or as a different MIME type.
The vulnerability enables two demonstrated outcomes. First, XSS occurs when the browser executes script content in a response that was not intended to be treated as HTML. Second, source code disclosure occurs when server-side script files are returned with a text-oriented content type rather than being executed by the origin handler.
Root Cause
The root cause is a combination of unchecked return values ([CWE-252]) in request body processing and improper output neutralization ([CWE-79]) affecting response Content-Type handling. The patched commit 6d7e8eb18f2d7d368fb8e29516fcdeaeb8d349b8 reworks error handling in apache2/mod_security2.c around read_request_body, addressing conditions where errors were not correctly propagated during request processing.
Attack Vector
The attack is remote and requires no authentication or user interaction beyond visiting a crafted URL or resource served by a vulnerable ModSecurity-fronted application. An attacker sends HTTP requests that trigger the response handling flaw. The WAF then returns responses where the Content-Type differs from the intended MIME type, allowing the attacker's payload to execute in the victim's browser or exposing server-side code.
}
rc = read_request_body(msr, &my_error_msg);
- if (rc < 0 && msr->txcfg->is_enabled == MODSEC_ENABLED) {
- switch(rc) {
- case -1 :
- if (my_error_msg != NULL) {
- msr_log(msr, 1, "%s", my_error_msg);
- }
- return HTTP_INTERNAL_SERVER_ERROR;
- break;
- case -4 : /* Timeout. */
- if (my_error_msg != NULL) {
- msr_log(msr, 4, "%s", my_error_msg);
- }
- r->connection->keepalive = AP_CONN_CLOSE;
- return HTTP_REQUEST_TIME_OUT;
- break;
- case -5 : /* Request body limit reached. */
- msr->inbound_error = 1;
- if((msr->txcfg->is_enabled == MODSEC_ENABLED) && (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_REJECT)) {
- r->connection->keepalive = AP_CONN_CLOSE;
- if (my_error_msg != NULL) {
- msr_log(msr, 1, "%s. Deny with code (%d)", my_error_msg, HTTP_REQUEST_ENTITY_TOO_LARGE);
- }
- return HTTP_REQUEST_ENTITY_TOO_LARGE;
- } else {
- if (my_error_msg != NULL) {
- msr_log(msr, 1, "%s", my_error_msg);
- }
Source: ModSecurity Patch Commit 6d7e8eb. This patch modifies request body handling and error propagation in mod_security2.c to close the conditions that allowed Content-Type override.
Detection Methods for CVE-2025-54571
Indicators of Compromise
- HTTP responses from ModSecurity-fronted servers where the Content-Type header does not match the file extension or handler expected for the resource.
- Responses returning server-side script files (for example .php, .jsp, .asp) with text/html or other renderable content types.
- Reflected script payloads in responses that pass through mod_security2 without triggering ruleset alerts.
Detection Strategies
- Compare deployed ModSecurity version against the fixed release. Any mod_security2 at 2.9.11 or below is vulnerable.
- Inspect audit logs for requests that generate anomalous response Content-Type values or unexpected 200 responses to script resources.
- Add integrity checks in CI to fail builds if the ModSecurity dependency is pinned below 2.9.12.
Monitoring Recommendations
- Alert on outbound responses where server-side script source code patterns appear in the response body.
- Log full request and response headers on the reverse proxy tier to correlate Content-Type discrepancies against client IPs.
- Monitor Debian LTS and OWASP security channels for further advisories referencing GHSA-cg44-9m43-3f9v.
How to Mitigate CVE-2025-54571
Immediate Actions Required
- Upgrade OWASP ModSecurity to version 2.9.12 or later on all Apache, IIS, and Nginx front-ends.
- Apply Debian LTS package updates as noted in the Debian LTS Security Announcement.
- Restart Apache or reload the ModSecurity module after patching to ensure the new binary is loaded into worker processes.
Patch Information
The fix is in ModSecurity 2.9.12, delivered through commit 6d7e8eb18f2d7d368fb8e29516fcdeaeb8d349b8. Details are published in GitHub Security Advisory GHSA-cg44-9m43-3f9v and tracked in GitHub Issue #2514.
Workarounds
- If immediate patching is not possible, place an additional response header rewrite rule at the reverse proxy that enforces the correct Content-Type based on file extension.
- Enable strict X-Content-Type-Options: nosniff on all responses to reduce browser MIME sniffing risk.
- Restrict handler mappings so server-side script extensions cannot be returned with text/html or text/plain.
# Apache configuration example enforcing nosniff and safe defaults
Header always set X-Content-Type-Options "nosniff"
Header always set Content-Security-Policy "default-src 'self'"
# Verify installed ModSecurity version
apachectl -M | grep security
dpkg -l | grep libapache2-mod-security2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
