V3: Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules

Coraza uses Go's mime.ParseMediaType to parse multipart upload filenames, which only decodes RFC 5987 filename* parameters if their charset is exactly us-ascii or utf-8. For other charsets like iso-8859-1, the standard library silently fails to decode filename*, leaving Coraza to use the plain filename or no filename at all. This discrepancy allows an attacker to present a benign filename to Coraza's FILES variable while the backend application receives a malicious filename, bypassing rules that block uploads by filename or extension. Additionally, parts with only filename* and no plain filename are not recognized as file uploads by Coraza, skipping file-specific rule scopes and size tracking. The vulnerability is a scope-changing bypass with low integrity impact and requires no authentication or user interaction. It was fixed by implementing independent decoding of filename* and populating the MULTIPART_FILENAME variable in Coraza 3.8.1.

This vulnerability allows attackers to bypass Coraza's file upload inspection rules that rely on the FILES variable by using a filename* parameter with a charset other than us-ascii or utf-8, such as iso-8859-1. As a result, malicious filenames can evade detection while the backend application processes the true filename, potentially allowing unauthorized file uploads or execution. The bypass affects filename-based inspection and file-vs-field routing, but does not affect inspection of request body content, ARGS, or headers. The impact is limited to scope-changing bypass with low integrity impact and no direct compromise or availability impact.

A fix is available in Coraza version 3.8.1 that independently decodes the filename* parameter without charset restrictions and correctly populates multipart filename variables. Users should upgrade to version 3.8.1 or later to remediate this vulnerability. Until upgraded, rules relying on FILES or FILES_NAMES for filename inspection may be bypassed by attackers using non-us-ascii/utf-8 charsets in filename*. No other mitigation is documented or recommended by the vendor advisory.