V3: Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

Coraza's JSON body processor converts nested JSON properties into flattened dot-separated keys in a single map without escaping dots in literal property names. This causes collisions when a nested property and a literal dotted property share the same flattened key, allowing the latter to overwrite the former. An attacker can exploit this by placing a malicious nested property (e.g., containing SQL injection payload) and a harmless dotted property with the same flattened key, causing Coraza to inspect only the harmless value and bypass OWASP CRS detection. The backend JSON parser preserves both properties distinctly, so the malicious payload reaches the backend undetected by Coraza. This flaw was demonstrated with a proof of concept against CRS v4.25 and affects Coraza versions >=3.0.0 <3.8.1.

An unauthenticated attacker can bypass OWASP Core Rule Set inspection by exploiting JSON key collisions in Coraza's JSON body processor. This allows malicious payloads, such as SQL injection attempts, to reach backend applications without being detected or blocked by Coraza and CRS. The vulnerability does not cause denial of service or data corruption within Coraza itself but undermines the effectiveness of the WAF inspection, potentially exposing backend systems to injection attacks.

A patch is available for this vulnerability. Users should upgrade Coraza to version 3.8.1 or later where this JSON key collision issue is fixed. Until patched, no reliable workaround is documented. The vendor advisory confirms the availability of an official fix. Users should apply the update promptly to restore effective OWASP CRS inspection of JSON request bodies.