V3: Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection

Coraza's request-body processor selection compares the entire Content-Type header value for exact equality, failing when parameters like charset are present (e.g., 'application/x-www-form-urlencoded; charset=UTF-8'). This causes the request body processor to remain unset, leading Coraza to evaluate phase 2 without parsing the body or setting error flags. Consequently, POST arguments are not inspected by Coraza rules, but the backend still receives and processes the full request body. This deterministic bypass allows an unauthenticated attacker to evade detection by custom rules targeting ARGS_POST or REQUEST_BODY. The issue affects Coraza versions >=3.0.4 and <3.8.1. The current OWASP CRS includes a fallback rule (901340) mitigating this bypass in unmodified configurations. A patch is available.

An unauthenticated attacker can bypass Coraza's request body inspection for URL-encoded forms with Content-Type headers containing parameters, such as charset. This allows malicious POST data to reach the backend without triggering Coraza's configured rules, potentially enabling command injection or other attacks that rely on POST parameters. The backend processes the full request body normally, but Coraza's inspection is incomplete, reducing the effectiveness of protections relying on ARGS_POST or REQUEST_BODY variables.

A patch is available for Coraza versions >=3.0.4 and <3.8.1 to fix this issue. Users should upgrade to a fixed version. Additionally, the current OWASP CRS includes rule 901340 which forces fallback inspection and mitigates this bypass path in unmodified configurations. No other specific actions are required if using the latest CRS and patched Coraza versions.