V3: Coraza has Cookie Parser Confusion

Coraza's internal cookie parser (internal/cookies.ParseCookies) trims only space and tab characters from cookie names and values, failing to remove the full ASCII control character range as defined by RFC 6265. This causes Coraza to interpret cookie names and values differently than several backend parsers, leading to a mismatch between the WAF's REQUEST_COOKIES/REQUEST_COOKIES_NAMES variables and the actual cookies processed by the application. An attacker can exploit this by inserting control characters adjacent to the '=' separator in the Cookie header, causing Coraza to index a different cookie name or value than the backend, potentially bypassing WAF rules targeting specific cookies. The fix trims the entire CTL range (0x00–0x20 plus 0x7F) from both ends of cookie names and values, aligning with RFC 6265's grammar. The fix is implemented with a byte-wise scan for performance reasons and is included in Coraza version 3.8.1 and later.

The vulnerability allows an attacker to craft Cookie headers with control characters adjacent to the '=' separator, causing Coraza to parse cookie names or values differently than the backend application. This discrepancy can lead to WAF rules scoped to specific cookie names or values missing malicious cookies, enabling a WAF bypass for cookie-based attacks. The impact is limited to information bypassing WAF detection and does not directly affect confidentiality or availability.

An official fix is available in Coraza version 3.8.1 that corrects the cookie parser to trim the full ASCII control character range from cookie names and values. Users should upgrade to version 3.8.1 or later to mitigate this issue. No additional action is required beyond applying the official patch.