CVE-2023-24021 Security feature bypass in n/a

High 7.5 Published 20 Jan 2023 Updated 2 Apr 2025

Attackers can bypass ModSecurity WAF protections and cause buffer over-reads by exploiting incorrect null byte handling in file uploads.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-24021?

CVE-2023-24021 is a high-severity vulnerability in Debian Debian Linux, published on 20 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.

Weakness: CWE-170

Which versions are affected by CVE-2023-24021?

2 open source packages ship an affected version, including modsecurity and modsecurity2. It affects 2 products.

Package	Affected	Fixed in
`modsecurity` Bitnami	All versions	`2.9.7`
`modsecurity2` Bitnami	All versions	`2.9.7`

Linux distribution packages (18)

`apache2-mod_security2` SUSE:Enterprise Storage 7	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Enterprise Storage 7.1	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Linux Enterprise Module for Server Applications 15 SP4	All versions	`2.9.4-150400.3.6.1`
`apache2-mod_security2` SUSE:Linux Enterprise Real Time 15 SP3	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Linux Enterprise Server 15 SP1-LTSS	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Linux Enterprise Server 15 SP2-LTSS	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Linux Enterprise Server 15 SP3-LTSS	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Linux Enterprise Server for SAP Applications 15 SP2	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Linux Enterprise Server for SAP Applications 15 SP3	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Manager Proxy 4.2	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Manager Retail Branch Server 4.2	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` SUSE:Manager Server 4.2	All versions	`2.9.2-150000.3.9.1`
`apache2-mod_security2` openSUSE:Leap 15.4	All versions	`2.9.4-150400.3.6.1`

Products include Debian Debian Linux, Trustwave Modsecurity.

How do I fix CVE-2023-24021?

Upgrade modsecurity to 2.9.7 or later.

Is CVE-2023-24021 being exploited?

There is no known exploitation of CVE-2023-24021 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-43843, AZL-44475, BIT-modsecurity-2023-24021, BIT-modsecurity2-2023-24021, DEBIAN-CVE-2023-24021, GHSA-845r-7x4c-q8qf and 3 more.