CVE-2025-29914

Executive Summary

CVE-2025-29914 is a medium-severity vulnerability in the OWASP Coraza Web Application Firewall (WAF), a Go-based ModSecurity-compatible library. The flaw allows an attacker to bypass WAF rules by sending a request with a URI that begins with a double slash (//). This causes Coraza to incorrectly set the REQUEST_FILENAME variable, stripping the leading path segment and potentially allowing malicious payloads to evade detection. The vulnerability affects all versions prior to 3.3.3 and has a CVSS score of 5.4. No public exploit code or proof-of-concept is currently available, but the attack vector is straightforward and could be weaponized.

Supply Chain & Package Security

This vulnerability affects the Go package github.com/corazawaf/coraza/v3. Organizations using Coraza as a library in their Go applications or as a reverse proxy should immediately update to version 3.3.3. The package is widely used in cloud-native environments and API gateways, making supply chain integrity critical. Verify the integrity of the updated package using Go module checksums (go.sum) and consider pinning the version in your go.mod file.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; a simple crafted URI is sufficient.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality Impact (C): Low (L) – Limited information disclosure possible.
• Integrity Impact (I): Low (L) – Limited ability to bypass rules, but not full compromise.
• Availability Impact (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but has limited impact. However, in environments where Coraza is the primary WAF, a bypass could allow attackers to deliver malicious payloads that would otherwise be blocked.

Deep Dive & Mechanics

The vulnerability lies in how Coraza parses the request URI to populate the REQUEST_FILENAME variable. When a URI starts with //, the Go HTTP server or the WAF's internal parser may interpret the double slash as a path separator, causing the first path segment to be dropped. For example:

• Request URI: //bar/uploads/foo.php?a=b
• Expected REQUEST_FILENAME: /bar/uploads/foo.php
• Actual REQUEST_FILENAME (vulnerable): /uploads/foo.php

This truncation means that any WAF rules that inspect REQUEST_FILENAME for patterns like /uploads/ or specific file extensions may be bypassed if the attacker prepends a // and a dummy path segment. The rule might be looking for /uploads/foo.php but the WAF sees /uploads/foo.php (without the /bar prefix), potentially matching a legitimate pattern and allowing the request.

The root cause is a lack of normalization for URIs starting with //. The fix in version 3.3.3 ensures that the URI is properly normalized before extracting REQUEST_FILENAME, preserving the full path.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 3.3.3):

// In the request parsing logic, the URI is used directly without normalization.
func parseRequest(r *http.Request) {
    // ...
    requestFilename := r.URL.Path // This may be "/uploads/foo.php" if URI is "//bar/uploads/foo.php"
    // ...
}

Patched Code (3.3.3):

// The URI is normalized to remove double slashes before extracting the path.
func parseRequest(r *http.Request) {
    // Normalize the URI path
    normalizedPath := path.Clean(r.URL.Path) // path.Clean resolves "//" to "/"
    requestFilename := normalizedPath
    // ...
}

The patch uses path.Clean to normalize the path, which collapses double slashes and resolves . and .. segments. This ensures that REQUEST_FILENAME is set to the correct, full path.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a vulnerable instance of Coraza (version < 3.3.3) as a reverse proxy or library. For example, use a Docker container with Coraza 3.3.2.
2. Craft the Payload: Send an HTTP request with a URI starting with // followed by a dummy path and the target path.

   GET //dummy/uploads/malicious.php?cmd=id HTTP/1.1
   Host: target.com
   

3. Bypass Rule: If a rule blocks /uploads/malicious.php, the WAF will see REQUEST_FILENAME as /uploads/malicious.php (without the /dummy prefix), potentially matching a whitelist or failing to match a blacklist.
4. Verify: Check the WAF logs to confirm that the rule was not triggered.

Blue Team (Detection & Hardening)

1. Monitor for Double Slash URIs: Look for HTTP requests with URIs containing // at the start. These are anomalous and may indicate an exploit attempt.
2. Update Immediately: Upgrade Coraza to version 3.3.3 or later.
3. Add Additional Rules: If immediate patching is not possible, add a custom rule to block or inspect URIs starting with //.

   SecRule REQUEST_URI "^//" "id:1000,phase:1,deny,status:403,msg:'Double slash URI detected'"
   

4. Log Analysis: Search for REQUEST_FILENAME values that differ from the original URI path.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with URIs starting with // (e.g., GET //dummy/path).
  • Anomalous REQUEST_FILENAME values in WAF logs that are shorter than the original URI.
• Host IOCs:
  • Coraza WAF logs showing REQUEST_FILENAME set to a truncated path.
  • Successful rule bypasses where a blocked payload is allowed through.

Detection Engineering

YARA Rule

rule CVE_2025_29914_Coraza_WAF_Bypass {
    meta:
        description = "Detects HTTP requests attempting to exploit CVE-2025-29914 by using a double slash URI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29914"
    strings:
        $double_slash = "//"
    condition:
        // Look for double slash at the start of the URI in HTTP request logs
        $double_slash at 0
}

Sigma Rule

title: CVE-2025-29914 Coraza WAF URI Double Slash Bypass
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with URIs starting with double slashes, indicating an attempt to bypass Coraza WAF rules.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: coraza
detection:
    selection:
        cs-uri-query|startswith: "//"
    condition: selection
falsepositives:
    - Rare legitimate use of double slash in URIs (e.g., some CDN configurations)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-29914 Coraza WAF URI Double Slash Bypass Attempt"; flow:to_server; http.uri; content:"//"; startswith; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade to Coraza version 3.3.3 or later. This is the only complete fix.
2. Workaround: If patching is delayed, add a custom WAF rule to block URIs starting with //:

   SecRule REQUEST_URI "^//" "id:1001,phase:1,deny,status:403,msg:'Blocked double slash URI'"
   

3. Network-Level Mitigation: Configure reverse proxies (e.g., Nginx, HAProxy) to normalize URIs before passing them to Coraza. For example, in Nginx:

   location / {
       rewrite ^//(.*)$ /$1 break;
       proxy_pass http://backend;
   }
   

4. Monitor & Audit: Enable detailed logging for Coraza and monitor for double slash URIs. Review logs for any successful bypasses.

Valters IT