CVE-2026-33691: OWASP CRS Auth Bypass Vulnerability

CVE-2026-33691 Overview

CVE-2026-33691 is a security bypass vulnerability in the OWASP Core Rule Set (CRS), a widely-deployed set of generic attack detection rules used with compatible web application firewalls (WAFs). The vulnerability allows attackers to bypass file upload restrictions by inserting whitespace padding in filenames, enabling the upload of files with dangerous extensions such as .php, .phar, .jsp, and .jspx.

Critical Impact
Attackers can bypass WAF protections to upload malicious executable files by inserting whitespace characters before file extensions (e.g., photo. php or shell.jsp ), potentially leading to remote code execution on vulnerable web servers.

Affected Products

OWASP Core Rule Set (CRS) versions prior to 3.3.9
OWASP Core Rule Set (CRS) versions prior to 4.25.0
Any WAF implementation using vulnerable CRS versions (ModSecurity, NGINX ModSecurity, etc.)

Discovery Timeline

April 2, 2026 - CVE-2026-33691 published to NVD
April 2, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33691

Vulnerability Analysis

This vulnerability is classified under CWE-178 (Improper Handling of Case Sensitivity), though it more specifically involves improper handling of whitespace characters in input validation. The core issue lies in the regex-based file extension checking within OWASP CRS rules that fails to account for whitespace padding in filenames before evaluating against dangerous extension patterns.

When a file upload request reaches a WAF protected by OWASP CRS, the rules examine the filename to detect potentially malicious extensions. However, the affected rules (specifically rules 932180, 933110, and 933111) apply the t:lowercase transformation but do not normalize whitespace before performing the regex evaluation. This allows an attacker to craft filenames with strategically placed whitespace characters that cause the dot-extension pattern match to fail.

The attack can be executed over the network without authentication, though it requires specific conditions to be met—the target application must accept file uploads and process the uploaded files in a manner that strips or ignores whitespace in filenames, while the underlying web server executes the file based on its extension.

Root Cause

The root cause is the absence of whitespace normalization in the transformation chain applied before regex evaluation in file upload restriction rules. The rules used t:none,t:lowercase transformations which convert the filename to lowercase but do not strip whitespace characters. This oversight allows whitespace-padded extensions to evade detection since the regex patterns match exact extension formats without accounting for embedded spaces.

Attack Vector

An attacker can exploit this vulnerability by:

Identifying a web application protected by OWASP CRS that allows file uploads
Crafting a malicious file with a dangerous extension padded with whitespace (e.g., webshell. php or backdoor.jsp )
Uploading the file through the standard upload mechanism
The WAF's CRS rules fail to detect the dangerous extension due to whitespace interference
If the backend application or web server normalizes the filename or executes based on the true extension, the malicious file can be executed

The attack requires network access and targets the integrity of the protected system by allowing unauthorized file uploads that could lead to remote code execution.

text

# Patch demonstrating the fix in REQUEST-932-APPLICATION-ATTACK-RCE.conf
     phase:2,\
     block,\
     capture,\
-    t:none,t:lowercase,\
+    t:none,t:lowercase,t:removeWhitespace,\
     msg:'Restricted File Upload Attempt',\
     logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
     tag:'application-multi',\

Source: GitHub Commit Update

text

# Patch demonstrating the fix in REQUEST-933-APPLICATION-ATTACK-PHP.conf
     phase:2,\
     block,\
     capture,\
-    t:none,t:lowercase,\
+    t:none,t:lowercase,t:removeWhitespace,\
     msg:'PHP Injection Attack: PHP Script File Upload Found',\
     logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',\
     tag:'application-multi',\

Source: GitHub Commit Update

Detection Methods for CVE-2026-33691

Indicators of Compromise

File upload requests containing filenames with whitespace characters before or within file extensions (e.g., file. php, shell .jsp, backdoor.phar )
Presence of unexpected executable files in upload directories with extensions that may have been normalized
WAF logs showing allowed file uploads that should have been blocked based on extension policies
Web server access logs indicating execution attempts of files in upload directories

Detection Strategies

Implement custom WAF rules that specifically detect whitespace characters in proximity to dangerous file extensions
Configure file integrity monitoring on upload directories to alert on new executable files
Analyze WAF logs for file upload requests with unusual filename patterns containing spaces near extension delimiters
Deploy endpoint detection to monitor for webshell behavior patterns following file uploads

Monitoring Recommendations

Enable detailed logging of all file upload requests including full filename metadata
Set up alerts for any files with executable extensions appearing in designated upload directories
Monitor web server processes for spawning unexpected child processes that could indicate webshell execution
Correlate WAF bypass attempts with subsequent application behavior anomalies

How to Mitigate CVE-2026-33691

Immediate Actions Required

Upgrade OWASP Core Rule Set to version 3.3.9 or 4.25.0 immediately
Review upload directories for any suspicious files that may have bypassed previous protections
Implement application-level filename sanitization that strips whitespace before extension evaluation
Temporarily restrict file upload functionality on critical systems until patches are applied

Patch Information

The OWASP CRS team has released patched versions that add the t:removeWhitespace transformation to the affected rules. This ensures whitespace characters are stripped from filenames before the regex evaluation occurs, preventing the bypass.

Version 3.3.9: GitHub Release v3.3.9
Version 4.25.0: GitHub Release v4.25.0

For detailed technical information, refer to the GitHub Security Advisory GHSA-rw5f-9w43-gv2w and the Openwall OSS-Security Discussion.

Workarounds

Add custom rules that apply t:removeWhitespace transformation before extension checking on existing CRS deployments
Implement application-layer filename validation that rejects files with whitespace in or near extensions
Configure the web server to reject file uploads with suspicious whitespace patterns in filenames
Use allowlist-based extension validation at the application level rather than relying solely on WAF blocklists

bash

# Example: Add removeWhitespace transformation to existing CRS rules
# Modify the affected rule transformations from:
# t:none,t:lowercase
# To:
# t:none,t:lowercase,t:removeWhitespace

# For ModSecurity, you can add a custom rule before CRS rules:
SecRule FILES_NAMES "@rx \s+\.\w+$|\.s+\w+$" \
    "id:900001,\
    phase:2,\
    block,\
    t:none,\
    msg:'File upload with whitespace in extension detected',\
    severity:'CRITICAL'"