CVE-2025-47947

Executive Summary

CVE-2025-47947 is a denial of service (DoS) vulnerability in ModSecurity, an open-source, cross-platform web application firewall (WAF) engine for Apache, IIS, and Nginx. Versions up to and including 2.9.8 are vulnerable when processing HTTP requests with a Content-Type of application/json and at least one rule that uses the sanitiseMatchedBytes action. An attacker can exploit this by sending a specially crafted JSON payload, causing excessive resource consumption and potentially crashing the WAF process. The CVSS score is 7.5 (High), and no public exploit code or proof-of-concept is currently available. A patch is available via pull request 3389 and is expected to be included in version 2.9.9.

Supply Chain & Package Security

This vulnerability affects the ModSecurity open-source project, which is a critical component in many web application security stacks. Organizations using ModSecurity as a WAF should treat this as a high-priority supply chain risk. The vulnerable component is the core engine, and the impact is denial of service, which can lead to application downtime and bypass of security controls. No known workarounds exist, so patching is essential.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The vulnerability can cause a complete denial of service.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, making it attractive for attackers to disrupt WAF services.

Deep Dive & Mechanics

The vulnerability resides in ModSecurity's JSON parsing and rule processing logic. When a request with Content-Type: application/json is received, ModSecurity parses the JSON body. If a rule with the sanitiseMatchedBytes action is present, the engine attempts to sanitize matched bytes in the JSON payload. The issue occurs due to improper handling of certain JSON structures, leading to excessive memory allocation or infinite loops during the sanitization process.

Specifically, the sanitiseMatchedBytes action is designed to replace matched malicious bytes with a safe character (e.g., *). However, when processing deeply nested or specially crafted JSON objects, the algorithm fails to terminate correctly, causing the WAF to consume all available CPU and memory resources. This results in a denial of service condition, where the ModSecurity process becomes unresponsive or crashes.

The vulnerability is triggered by a combination of:

1. A request with Content-Type: application/json.
2. At least one rule in the ModSecurity configuration that uses the sanitiseMatchedBytes action.
3. A specially crafted JSON payload that exploits the flawed sanitization logic.

Vulnerable vs. Patched Code

The vulnerable code is in the JSON sanitization routine within ModSecurity's core. The exact code is not publicly disclosed, but the patch (PR #3389) addresses the issue by fixing the loop termination condition and adding bounds checking.

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable sanitizeMatchedBytes
void sanitizeMatchedBytes(char *json, int len) {
    int i = 0;
    while (i < len) {
        if (json[i] == '\\') {
            // Handle escape sequences
            i += 2;
        } else if (json[i] == '"') {
            // Handle string boundaries
            i++;
            while (json[i] != '"' && i < len) {
                if (json[i] == '\\') {
                    i += 2;
                } else {
                    i++;
                }
            }
        } else {
            // Replace matched bytes
            json[i] = '*';
            i++;
        }
    }
}

Patched Code (Conceptual):

// Pseudocode for patched sanitizeMatchedBytes
void sanitizeMatchedBytes(char *json, int len) {
    int i = 0;
    while (i < len) {
        if (json[i] == '\\') {
            // Handle escape sequences with bounds check
            if (i + 1 < len) {
                i += 2;
            } else {
                break;
            }
        } else if (json[i] == '"') {
            // Handle string boundaries with bounds check
            i++;
            while (i < len && json[i] != '"') {
                if (json[i] == '\\') {
                    if (i + 1 < len) {
                        i += 2;
                    } else {
                        break;
                    }
                } else {
                    i++;
                }
            }
            if (i < len) {
                i++; // Skip closing quote
            }
        } else {
            // Replace matched bytes
            json[i] = '*';
            i++;
        }
    }
}

The patch adds proper bounds checking to prevent out-of-bounds access and ensures the loop terminates correctly even with malformed JSON.

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service on a ModSecurity WAF running version 2.9.8 or earlier.

Prerequisites:

• Target system running ModSecurity 2.9.8 with a rule that uses sanitiseMatchedBytes.
• Network access to the target.

Exploitation Steps:

1. Identify a target with ModSecurity 2.9.8 (e.g., via Shodan dork: "ModSecurity" "2.9.8").
2. Craft a malicious JSON payload that triggers the vulnerability. The payload should contain deeply nested objects or specially crafted escape sequences.
3. Send the payload with Content-Type: application/json to the target.
4. Monitor the target's response. If successful, the WAF will become unresponsive or crash, leading to a denial of service.

Example Payload (Conceptual):

{
  "a": "b",
  "c": {
    "d": "e",
    "f": {
      "g": "h",
      "i": {
        "j": "k",
        "l": {
          "m": "n",
          "o": {
            "p": "q",
            "r": {
              "s": "t",
              "u": {
                "v": "w",
                "x": {
                  "y": "z",
                  "z": "\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000"
                }
              }
            }
          }
        }
      }
    }
  }
}

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for excessive CPU or memory usage by the ModSecurity process.
• Look for repeated requests with Content-Type: application/json and unusual JSON structures.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Apply the patch from PR #3389 or upgrade to ModSecurity 2.9.9 when available.
• If patching is not immediately possible, consider temporarily disabling rules that use sanitiseMatchedBytes for JSON content types.
• Implement rate limiting for requests with Content-Type: application/json.
• Use a Web Application Firewall (WAF) in front of ModSecurity to filter malicious payloads.

Hunting:

• Search logs for ModSecurity crashes or restarts.
• Analyze network traffic for JSON payloads with excessive nesting or unusual escape sequences.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with Content-Type: application/json and deeply nested JSON objects.
  • Repeated requests from the same IP address targeting ModSecurity endpoints.
• System:
  • High CPU or memory usage by the ModSecurity process.
  • ModSecurity process crashes or unexpected restarts.
  • Log entries indicating "Out of memory" or "Segmentation fault" in ModSecurity logs.
• File:
  • ModSecurity audit logs showing truncated or malformed JSON payloads.

Detection Engineering

YARA Rule

rule CVE_2025_47947_ModSecurity_DoS {
    meta:
        description = "Detects malicious JSON payloads targeting CVE-2025-47947 in ModSecurity"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-47947"
        severity = "high"
    strings:
        $json_content_type = "Content-Type: application/json" nocase
        $deep_nesting = /"\{[^}]*\{[^}]*\{[^}]*\{[^}]*\{[^}]*\{[^}]*\{[^}]*\{[^}]*\{[^}]*\{[^}]*\}/ 
        $escape_sequence = /\\u[0-9a-fA-F]{4}/
    condition:
        $json_content_type and ($deep_nesting or #escape_sequence > 10)
}

Sigma Rule

title: CVE-2025-47947 ModSecurity DoS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-47947 via malicious JSON payloads
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-47947
logsource:
    category: webserver
    product: modsecurity
detection:
    selection:
        http.content_type: "application/json"
        http.request_body|contains: 
            - '{"a":"b","c":{"d":"e","f":{"g":"h","i":{"j":"k","l":{"m":"n","o":{"p":"q","r":{"s":"t","u":{"v":"w","x":{"y":"z","z":"\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000"}}}}}}}}'
    condition: selection
falsepositives:
    - Legitimate deeply nested JSON from trusted sources
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47947 ModSecurity DoS Attempt"; flow:to_server; content:"Content-Type: application/json"; http_header; pcre:"/\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{/Ri"; sid:1000001; rev:1; reference:cve,2025-47947; priority:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch from ModSecurity pull request #3389. This is the only known fix.
2. If patching is not possible, temporarily disable any ModSecurity rules that use the sanitiseMatchedBytes action for JSON content types.
3. Implement rate limiting for requests with Content-Type: application/json to reduce the impact of potential DoS attacks.

Long-Term Actions:

1. Upgrade to ModSecurity version 2.9.9 or later when it is released.
2. Regularly review and update ModSecurity rules to minimize the use of resource-intensive actions like sanitiseMatchedBytes.
3. Implement a layered security approach, including network-level WAFs and intrusion detection systems.
4. Monitor ModSecurity logs for signs of exploitation and tune detection rules accordingly.

Workarounds:

• No known workarounds are available. The only mitigation is to patch or disable the vulnerable functionality.

Valters IT
Securing Your Digital Frontier