Coraza Files

Coraza v3.8.1 is a security release. It completes several fixes that shipped in v3.8.0 and fixes a process crash. All users should upgrade, including those still on v3.7.x and earlier, which are affected by most of these issues too.

Security fixes

Bug fixes

• fix(bodyprocessors): don't flag multipart strict error on ProcessPartial truncation by @M4tteoP in https://github.com/corazawaf/coraza/pull/1725 Regression in v3.8.0: with SecRequestBodyLimitAction ProcessPartial, rule 200003 rejected every multipart upload larger than the body limit.
• fix(bodyprocessors): make multipart duplicate-param check linear by @fzipi in https://github.com/corazawaf/coraza/pull/1726
• fix(bodyprocessors): report JSON flatten budget overrun as a body error by @M4tteoP in https://github.com/corazawaf/coraza/pull/1730
• fix(json bodyprocessor): don't count JSON array-length entries toward SecArgumentsLimit by @M4tteoP in https://github.com/corazawaf/coraza/pull/1729 A JSON array with exactly SecArgumentsLimit elements was rejected in v3.8.0.

Documentation and chores

• docs: clarify SecArgumentsLimit scope and enable it in coraza.conf-recommended by @M4tteoP in https://github.com/corazawaf/coraza/pull/1727
• docs(variables): fix stale multipart variable docs by @M4tteoP in https://github.com/corazawaf/coraza/pull/1728
• docs(security): score exploitability preconditions during triage by @fzipi in https://github.com/corazawaf/coraza/pull/1722
• chore: add .coderabbit.yaml with organization inheritance by @fzipi in https://github.com/corazawaf/coraza/pull/1721

Behaviour changes

Coming from v3.8.0:

• Duplicate Content-Type headers: the first header now selects the body processor, matching what Header.Get (and so a typical backend) reads. Before, the last matching header won.
• filename* with numbered continuations (filename*0=, filename*0*=, ...): the request now sets MULTIPART_STRICT_ERROR, so rule 200003 in the recommended config rejects it with 400.
• JSON bodies over the flattening memory budget now set REQBODY_ERROR, so rule 200002 rejects them with 400. Before, they were only truncated.
• Empty cookie names: REQUEST_COOKIES and REQUEST_COOKIES_NAMES can now contain an entry named "" (e.g. from Cookie: =value), and &REQUEST_COOKIES counts it. This is an intentional deviation: ModSecurity v2 and v3 skip such cookies, but some backends (e.g. Node's cookie package) pass them to the application. A bare = is still skipped.
• Regex ctl target removals (ctl:ruleRemoveTargetById=N;ARGS:/re/) no longer remove entries named "" unless the regex matches the empty string.
• JSON array-length entries (json.a = array length) no longer count toward SecArgumentsLimit.
• coraza.conf-recommended: SecArgumentsLimit 1000 is now set explicitly; before it was commented out. The limit applies per source (ARGS_GET, ARGS_PATH, ARGS_POST, RESPONSE_ARGS). The commented-out examples no longer reuse rule ids 200004 and 200005.

[!IMPORTANT] Running without the recommended config's rules 200004 and 200005? SecArgumentsLimit defaults to 1000 even when it is not set. Since v3.8.0, arguments beyond that limit, from the query string and from urlencoded or JSON bodies, are dropped from the tail and only ARGUMENTS_LIMIT_REACHED is set. A config with no rule acting on that flag (e.g. CRS on its own, or an older vendored copy of coraza.conf-recommended) does not inspect those arguments. Add rules 200004 and 200005 from coraza.conf-recommended, or an equivalent rule on ARGUMENTS_LIMIT_REACHED.

Coming from v3.7.x, also read the v3.8.0 release notes. Of note:

• SecArgumentsLimit (default 1000) now also applies to urlencoded and JSON request bodies. Requests that exceed it are rejected by rules 200004/200005. Raise the limit if your APIs legitimately send more values.
• New rule 200009 in coraza.conf-recommended returns 400 for URIs that fail to parse: invalid path escapes (/50%off, %zz), a bad port, or no leading /.
• URLENCODED_ERROR is no longer set when the request URI fails to parse. Use the new URI_PARSE_ERROR variable instead; rule 200009 relies on it.
• Rule 200003 now returns 400 for multipart parts with malformed or duplicate headers, which previously hid uploaded files from rule inspection. A part with only filename* now goes to FILES instead of ARGS_POST.
• New methods on plugintypes.TransactionVariables break external implementations at compile time.
• New types/variables constants were inserted mid-iota, which renumbers the constants after them.

Full Changelog: https://github.com/corazawaf/coraza/compare/v3.8.0...v3.8.1