Vulnerability Details CVE-2021-42717
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.018
EPSS Ranking 81.8%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References
- https://lists.debian.org/debian-lts-announce/2022/05/msg00042.html
- https://www.debian.org/security/2021/dsa-5023
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-dos-vulnerability-in-json-parsing-cve-2021-42717/
- https://lists.debian.org/debian-lts-announce/2022/05/msg00042.html
- https://www.debian.org/security/2021/dsa-5023
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-dos-vulnerability-in-json-parsing-cve-2021-42717/
Products affected by CVE-2021-42717
-
cpe:2.3:a:f5:nginx_modsecurity_waf:r24
-
cpe:2.3:a:f5:nginx_modsecurity_waf:r25
-
cpe:2.3:a:oracle:http_server:12.2.1.3.0
-
cpe:2.3:a:oracle:http_server:12.2.1.4.0
-
cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8
-
cpe:2.3:a:trustwave:modsecurity:2.0.0
-
cpe:2.3:a:trustwave:modsecurity:2.0.1
-
cpe:2.3:a:trustwave:modsecurity:2.0.2
-
cpe:2.3:a:trustwave:modsecurity:2.0.3
-
cpe:2.3:a:trustwave:modsecurity:2.0.4
-
cpe:2.3:a:trustwave:modsecurity:2.1.0
-
cpe:2.3:a:trustwave:modsecurity:2.1.1
-
cpe:2.3:a:trustwave:modsecurity:2.1.2
-
cpe:2.3:a:trustwave:modsecurity:2.1.3
-
cpe:2.3:a:trustwave:modsecurity:2.1.4
-
cpe:2.3:a:trustwave:modsecurity:2.1.5
-
cpe:2.3:a:trustwave:modsecurity:2.1.6
-
cpe:2.3:a:trustwave:modsecurity:2.1.7
-
cpe:2.3:a:trustwave:modsecurity:2.2.0
-
cpe:2.3:a:trustwave:modsecurity:2.5.0
-
cpe:2.3:a:trustwave:modsecurity:2.5.1
-
cpe:2.3:a:trustwave:modsecurity:2.5.10
-
cpe:2.3:a:trustwave:modsecurity:2.5.11
-
cpe:2.3:a:trustwave:modsecurity:2.5.12
-
cpe:2.3:a:trustwave:modsecurity:2.5.13
-
cpe:2.3:a:trustwave:modsecurity:2.5.2
-
cpe:2.3:a:trustwave:modsecurity:2.5.3
-
cpe:2.3:a:trustwave:modsecurity:2.5.4
-
cpe:2.3:a:trustwave:modsecurity:2.5.5
-
cpe:2.3:a:trustwave:modsecurity:2.5.6
-
cpe:2.3:a:trustwave:modsecurity:2.5.7
-
cpe:2.3:a:trustwave:modsecurity:2.5.8
-
cpe:2.3:a:trustwave:modsecurity:2.5.9
-
cpe:2.3:a:trustwave:modsecurity:2.6.0
-
cpe:2.3:a:trustwave:modsecurity:2.6.1
-
cpe:2.3:a:trustwave:modsecurity:2.6.2
-
cpe:2.3:a:trustwave:modsecurity:2.6.3
-
cpe:2.3:a:trustwave:modsecurity:2.6.4
-
cpe:2.3:a:trustwave:modsecurity:2.6.5
-
cpe:2.3:a:trustwave:modsecurity:2.6.6
-
cpe:2.3:a:trustwave:modsecurity:2.6.7
-
cpe:2.3:a:trustwave:modsecurity:2.6.8
-
cpe:2.3:a:trustwave:modsecurity:2.7.0
-
cpe:2.3:a:trustwave:modsecurity:2.7.1
-
cpe:2.3:a:trustwave:modsecurity:2.7.2
-
cpe:2.3:a:trustwave:modsecurity:2.7.3
-
cpe:2.3:a:trustwave:modsecurity:2.7.4
-
cpe:2.3:a:trustwave:modsecurity:2.7.5
-
cpe:2.3:a:trustwave:modsecurity:2.7.6
-
cpe:2.3:a:trustwave:modsecurity:2.7.7
-
cpe:2.3:a:trustwave:modsecurity:2.8.0
-
cpe:2.3:a:trustwave:modsecurity:2.9.0
-
cpe:2.3:a:trustwave:modsecurity:2.9.1
-
cpe:2.3:a:trustwave:modsecurity:2.9.2
-
cpe:2.3:a:trustwave:modsecurity:2.9.3
-
cpe:2.3:a:trustwave:modsecurity:2.9.4
-
cpe:2.3:a:trustwave:modsecurity:3.0.0
-
cpe:2.3:a:trustwave:modsecurity:3.0.1
-
cpe:2.3:a:trustwave:modsecurity:3.0.2
-
cpe:2.3:a:trustwave:modsecurity:3.0.3
-
cpe:2.3:a:trustwave:modsecurity:3.0.4
-
cpe:2.3:a:trustwave:modsecurity:3.0.5
-
cpe:2.3:o:debian:debian_linux:10.0
-
cpe:2.3:o:debian:debian_linux:11.0
-
cpe:2.3:o:debian:debian_linux:9.0