{"id":"CVE-2026-62971","kind":"vulnerability","aliases":["CVE-2026-62971"],"related":[],"title":"OWASP CRS: XML attribute payloads bypass web application firewall rule detection","description":"The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (generic), 941 (XSS), 942 (SQLi), and 943 (session-fixation) families inspect XML request bodies via the XPath expression XML:/*. That expression matches only element text nodes — it does not match XML attribute values. As a result, an attacker who places an attack payload inside an XML attribute (e.g. <a href=\"javascript:alert(1)=window.name\"></a> or <a value=\"' OR 1=1 --\"></a>) bypasses CRS detection entirely. This is verified empirically against a local CRS test instance and against the public CRS sandbox. The bypass affects approximately 159 rules across 9 rule files and applies at every paranoia level (PL1 through PL4), since the variable list is more or less shared across PLs. The 944 (Java) family is the only one that correctly includes XML://@* in addition to XML:/* and is therefore unaffected. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.","summary":"The OWASP Core Rule Set's XML rules inspect only element text and skip attribute values, so attack payloads placed in XML attributes pass through unchecked. An attacker can send SQL injection, XSS or other attack strings in XML attributes to bypass the firewall's detection.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache","modsecurity","nginx","owasp-crs","package","waf","xml-api"],"not_affected_if":["java-rules-only","no-xml-requests","non-crs-waf"],"how_to_check":"- Check the installed CRS version in your WAF's rules directory or package manifest, for example `cat REQUEST-901-INITIALIZATION.conf` or the package version in your dependency file.\n- Confirm whether your application accepts XML request bodies that reach the WAF with CRS rules from families 921 to 943 enabled.","fix":"- OWASP CRS versions `3.3.10`, `4.25.1`, and `4.28.0` contain the patch; upgrade the branch you run to one of these.","status":"open","published_at":"2026-11-11T18:19:47+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","triaged_at":"2026-11-11T18:29:28+00:00","updated_at":"2026-11-11T18:29:28+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T18:29:28Z","model":"claude-haiku-5-5","output":{"fix":"- OWASP CRS versions `3.3.10`, `4.25.1`, and `4.28.0` contain the patch; upgrade the branch you run to one of these.","reach":"internet","title":"OWASP CRS: XML attribute payloads bypass web application firewall rule detection","impact":"medium","summary":"The OWASP Core Rule Set's XML rules inspect only element text and skip attribute values, so attack payloads placed in XML attributes pass through unchecked. An attacker can send SQL injection, XSS or other attack strings in XML attributes to bypass the firewall's detection.","audience":"businesses","category":"package","nicknames":[],"who_cares":["owasp-crs","waf","modsecurity","nginx","apache","xml-api"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attack payloads in XML attributes evade WAF detection and reach the application.","analyst_note":"","how_to_check":"- Check the installed CRS version in your WAF's rules directory or package manifest, for example `cat REQUEST-901-INITIALIZATION.conf` or the package version in your dependency file.\n- Confirm whether your application accepts XML request bodies that reach the WAF with CRS rules from families 921 to 943 enabled.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-xml-requests","java-rules-only","non-crs-waf"],"who_is_affected":"Sites and APIs that run the OWASP Core Rule Set in a web application firewall and accept XML request bodies are exposed, since the XML inspection expression misses attribute values in the 921 to 943 rule families. Installations that do not use CRS, do not accept XML, or run only the 944 Java rules are not affected by this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000826,"input_tokens":4943,"output_tokens":664,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-62971':14A,17A '159':194C '3.3.10':99C,246C '4.25.1':100C,247C '4.28.0':102C,249C '9':197C '921':107C '930':111C '931':113C '932':115C '933':117C '934':119C '941':121C '942':123C '943':126C '944':221C 'across':196C,218C 'addit':232C 'affect':192C 'apach':18B 'api':28B 'appli':201C 'applic':8A,94C 'approxim':193C 'attack':46B,56B,64B,86C,110C,158C,162C 'attribut':4A,43B,51B,68B,152C,167C 'bodi':134C 'bypass':6A,70B,170C,191C 'compat':92C 'core':31B,77C 'correct':229C 'crs':2A,23B,80C,103C,171C,181C,188C 'cve':12A,15A 'detect':11A,74B,87C,172C 'e.g':168C 'element':39B,144C 'empir':177C 'entir':173C 'everi':203C 'express':138C,141C 'famili':130C,223C 'file':199C 'firewal':9A,72B,95C 'fixat':129C 'generic':85C,120C 'includ':230C 'inject':60B 'insid':164C 'inspect':37B,131C 'instanc':183C 'issu':240C 'java':222C 'less':216C 'level':205C 'lfi':112C 'list':212C 'local':180C 'match':142C,150C 'modsecur':19B 'nginx':20B 'node':146C 'one':227C 'owasp':1A,22B,30B,76C 'owasp-cr':21B 'packag':24B 'paranoia':204C 'pass':52B 'patch':243C 'payload':5A,47B,163C 'php':118C 'pl1':206C 'pl4':208C 'place':48B,160C 'pls':219C 'prior':96C 'protocol':109C 'protocol-attack':108C 'public':187C 'rce':116C 'request':133C 'result':156C 'rfi':114C 'rule':10A,32B,36B,78C,88C,104C,195C,198C 'sandbox':189C 'send':58B 'session':128C 'session-fix':127C 'set':33B,79C,83C 'share':217C 'sinc':209C 'skip':42B 'sql':59B 'sqli':124C 'string':65B 'test':182C 'text':40B,145C 'therefor':237C 'unaffect':238C 'uncheck':54B 'use':90C 'valu':44B,153C 'variabl':211C 'verifi':176C 'version':98C,245C 'via':135C 'waf':25B 'web':7A,93C 'xml':3A,27B,35B,50B,67B,132C,139C,151C,166C,234C 'xml-api':26B 'xpath':137C 'xss':61B,122C","nicknames":[],"mitigations":[],"who_affected":"Sites and APIs that run the OWASP Core Rule Set in a web application firewall and accept XML request bodies are exposed, since the XML inspection expression misses attribute values in the 921 to 943 rule families. Installations that do not use CRS, do not accept XML, or run only the 944 Java rules are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apache","high","modsecurity","nginx","owaspcrs","package","waf","xmlapi"],"campaign_type":null,"search_a":"'-2026':13A,16A '-62971':14A,17A 'applic':8A 'attribut':4A 'bypass':6A 'crs':2A 'cve':12A,15A 'detect':11A 'firewal':9A 'owasp':1A 'payload':5A 'rule':10A 'web':7A 'xml':3A","search_b":"'apach':18B 'api':28B 'attack':46B,56B,64B 'attribut':43B,51B,68B 'bypass':70B 'core':31B 'crs':23B 'detect':74B 'element':39B 'firewal':72B 'inject':60B 'inspect':37B 'modsecur':19B 'nginx':20B 'owasp':22B,30B 'owasp-cr':21B 'packag':24B 'pass':52B 'payload':47B 'place':48B 'rule':32B,36B 'send':58B 'set':33B 'skip':42B 'sql':59B 'string':65B 'text':40B 'uncheck':54B 'valu':44B 'waf':25B 'xml':27B,35B,50B,67B 'xml-api':26B 'xss':61B","search_c":"'159':194C '3.3.10':99C,246C '4.25.1':100C,247C '4.28.0':102C,249C '9':197C '921':107C '930':111C '931':113C '932':115C '933':117C '934':119C '941':121C '942':123C '943':126C '944':221C 'across':196C,218C 'addit':232C 'affect':192C 'appli':201C 'applic':94C 'approxim':193C 'attack':86C,110C,158C,162C 'attribut':152C,167C 'bodi':134C 'bypass':170C,191C 'compat':92C 'core':77C 'correct':229C 'crs':80C,103C,171C,181C,188C 'detect':87C,172C 'e.g':168C 'element':144C 'empir':177C 'entir':173C 'everi':203C 'express':138C,141C 'famili':130C,223C 'file':199C 'firewal':95C 'fixat':129C 'generic':85C,120C 'includ':230C 'insid':164C 'inspect':131C 'instanc':183C 'issu':240C 'java':222C 'less':216C 'level':205C 'lfi':112C 'list':212C 'local':180C 'match':142C,150C 'node':146C 'one':227C 'owasp':76C 'paranoia':204C 'patch':243C 'payload':163C 'php':118C 'pl1':206C 'pl4':208C 'place':160C 'pls':219C 'prior':96C 'protocol':109C 'protocol-attack':108C 'public':187C 'rce':116C 'request':133C 'result':156C 'rfi':114C 'rule':78C,88C,104C,195C,198C 'sandbox':189C 'session':128C 'session-fix':127C 'set':79C,83C 'share':217C 'sinc':209C 'sqli':124C 'test':182C 'text':145C 'therefor':237C 'unaffect':238C 'use':90C 'valu':153C 'variabl':211C 'verifi':176C 'version':98C,245C 'via':135C 'web':93C 'xml':132C,139C,151C,166C,234C 'xpath':137C 'xss':122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T07:11:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62971","severity":null,"published_at":"2026-11-11T18:19:47+00:00","modified_at":"2026-11-11T18:19:47+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","fetched_at":"2026-11-11T18:28:43+00:00","note":null}],"documents":[{"id":127740,"url":"https://github.com/coreruleset/coreruleset/commit/275d7616f1ceb6f1024c3bfbeb1f4ae2ae9ad010","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":127741,"url":"https://github.com/coreruleset/coreruleset/commit/635cecf8f81908f02a687db4b5b13a55c3e3b9ed","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":127742,"url":"https://github.com/coreruleset/coreruleset/commit/852036b6af5e81d60d7234f69137d47f4ecb89dc","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":127743,"url":"https://github.com/coreruleset/coreruleset/security/advisories/GHSA-6jp8-c2w2-x7wr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T07:11:00+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}