V3: Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations

The vulnerability in Coraza v3 (versions >=3.0.0 <3.8.0) arises from the use of Go's url.ParseRequestURI function in the ProcessURI method. When this function returns an error due to raw control bytes in the URI, the fallback code that should extract GET arguments from the raw URI is commented out, causing ARGS_GET and QUERY_STRING variables to be empty. Consequently, rules targeting these variables do not trigger, allowing an attacker to bypass detection when the URI contains control characters. This issue is not present in standard net/http integrations because malformed URIs are rejected with HTTP 400 before ProcessURI is called. However, it affects non-net/http integrations that forward raw URI bytes directly to ProcessURI, such as coraza-spoa (HAProxy SPOP agent) and coraza-proxy-wasm (Envoy WASM filter). The vulnerability has an attack complexity of high due to the need to bypass standard Go HTTP parsing. A patch is available to address this issue.

Attackers can bypass detection rules that inspect GET parameters and query strings in Coraza integrations that do not use Go's standard net/http parser. Specifically, any rules targeting ARGS_GET, ARGS, ARGS_NAMES, ARGS_GET_NAMES, or QUERY_STRING will not trigger if the URI contains raw control bytes causing the URI parse to fail. This allows malicious payloads to evade OWASP CRS GET-side signature rules, potentially leading to undetected injection or other attacks. The vulnerability does not affect standard net/http deployments, which reject malformed URIs with HTTP 400 responses.

A patch is available for Coraza v3 to fix this issue. Users should upgrade to version 3.8.0 or later where the fallback logic for extracting GET arguments on URI parse failure is properly implemented. For non-net/http integrations, ensure that URIs are validated or sanitized before passing to ProcessURI. Standard net/http integrations are not affected and require no additional action.