210 matches found
gotestwaf
GoTestWAF GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, SOAP, XMLRPC, and others. It was designed to evaluate web application security solutions, such as API security proxies, Web Application Firewalls, IPS, API...
coreruleset
Branch| Status ---|--- main| 🛡️ OWASP CRS The OWASP CRS is a set of generic attack detection rules for use with OWASP ModSecurity, OWASP Coraza, or other compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a...
CVE-2026-21876
CVE-2026-21876 OWASP CRS WAF bypass CVE-2026-21876 docker container + minimal PoC. I would like to thank @airween and @fzipi separately for their quick response! The vulnerability fix was ready in a very short time. PoC Run: cd springbootundertowstand or aspnetstand docker compose up --build...
log4shell-coraza
Log4Shell Security Lab — nginx + Coraza WAF Educational / defensive purpose : this lab contains a deliberately vulnerable app Log4j 2.14.1 and a JNDI exploit kit, ONLY for learning how to detect and block Log4Shell in an isolated environment. Do not deploy to the Internet, do not use to attack...
Drupal-Exploit-Lab
Drupal-Exploit-Lab Demonstration on exploitation on Drupal 7.57 CVE-2018-7600 with and without WAFWeb Application Firewall Description The project shows how the exploitation of Drupal 7.57 looks like in two different scenarios: 1. Unprotected server → successful exploitation with Metasploit and...
CVE-2026-21876
CVE-2026-21876 OWASP CRS WAF bypass CVE-2026-21876 docker container + minimal PoC. I would like to thank @airween and @fzipi separately for their quick response! The vulnerability fix was ready in a very short time. PoC POST /submit HTTP/1.1 Host: localhost User-Agent: curl/8.17.0 Accept: / Origi...
CRSprober
CRSprober Description This tool remotely detects the version of the OWASP Core Rule Set CRS used by a ModSecurity WAF. It also identifies the configured paranoia level PL of the CRS, providing insights into the WAF's security posture without requiring local access. Prerequisities Python 3 Usage...
web-threat-mitigation
web-threat-mitigation Hands-on lab on detecting and mitigating web app threats using OWASP ZAP, Burp Suite, and ModSecurity WAF with OWASP CRS. Case study: Spring4Shell CVE-2022-22965. Local Docker-based setup. Web Threat Mitigation Lab – OWASP ZAP, ModSecurity & CVE Exploitation This repository...
Coraza Body Processor Has A JSON Key Collision That Allows Unauthenticated Attackers To Bypass OWASP CRS Inspection
Summary Coraza's JSON body processor converts nested JSON properties into dot-separated "ARGSPOST" names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious...
GO-2026-6692 Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza...
PT-2026-118014
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza...
CVE-2026-41510
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGSPOST without enforcing the cap. The fl...
GHSA-5GJ4-9GM7-2FX2 Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection
Summary Coraza's JSON body processor converts nested JSON properties into dot-separated ARGSPOST names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious val...
Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection
Summary Coraza's JSON body processor converts nested JSON properties into dot-separated ARGSPOST names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious val...
PT-2026-117204
Summary Coraza's JSON body processor converts nested JSON properties into dot-separated ARGS POST names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable An unauthenticated attacker can place a malicious...
anji-common-addons (>=0.3.0, <=0.3.2), anji-core (>=0.8.3, <=0.8.11) +9 more potentially affected by CVE-2026-114094 via dulwich (>=1.0.0, <=1.2.6)
dulwich PYPI version =1.0.0, =0.3.0, =0.8.3, =1.10.0, =0.3.1, =5.30.0, =5.30.0, =0.1.9, =0.2.1 Source cves: CVE-2026-114094 Source advisory: OSV:GHSA-8MCX-5RQC-VHMF...
anji-common-addons (>=0.3.0, <=0.3.2), anji-core (>=0.8.3, <=0.8.11) +9 more potentially affected by CVE-2026-114094 via dulwich (>=1.0.0, <=1.2.6)
dulwich PYPI version =1.0.0, =0.3.0, =0.8.3, =1.10.0, =0.3.1, =5.30.0, =5.30.0, =0.1.9, =0.2.1 Source cves: CVE-2026-114094 Source advisory: SNYK:PYTHON-DULWICH-20416732...
anji-common-addons (>=0.3.0, <=0.3.2), anji-core (>=0.8.3, <=0.8.11) +9 more potentially affected by unknown CVE via dulwich (>=1.0.0, <=1.2.6)
dulwich PYPI version =1.0.0, =0.3.0, =0.8.3, =1.10.0, =0.3.1, =5.30.0, =5.30.0, =0.1.9, =0.2.1 Source cves: unknown CVE Source advisory: GHSA-8MCX-5RQC-VHMF...
anji-common-addons (>=0.3.0, <=0.3.2), anji-core (>=0.8.3, <=0.8.11) +9 more potentially affected by unknown CVE via dulwich (>=1.0.0, <=1.2.6)
dulwich PYPI version =1.0.0, =0.3.0, =0.8.3, =1.10.0, =0.3.1, =5.30.0, =5.30.0, =0.1.9, =0.2.1 Source cves: unknown CVE Source advisory: GHSA-35MR-4567-66VG...
