Hackingrepo

Certain rule families (921, 930, 931, 932, 933, 934, 941, 942, and 943) inspect XML request bodies using the XPath expression `XML:/*`. This expression only matches element text nodes and fails to match XML attribute values. Consequently, an attacker can bypass detection by placing a payload within an XML attribute. This issue affects approximately 159 rules across 9 rule files and persists across all paranoia levels (PL1 through PL4).

In the Node.js environment, the `Http2Sessions` component fails to implement proper error handling for `ClientHttp2Session` during the initialization or reuse of HTTP/2 sessions. When a request is configured with `httpVersion: 2` and the `ClientHttp2Session` emits an error, the error bypasses standard Promise rejection handling. This uncaught exception can lead to the termination of the Node.js process, resulting in a denial of service.

A bypass exists in the OWASP Core Rule Set (CRS), a set of generic attack detection rules for web application firewalls. The issue allows the upload of files with dangerous extensions such as `.php`, `.phar`, `.jsp`, and `.jspx` by inserting whitespace padding into the filename. This occurs because the affected rules fail to normalize whitespace before evaluating the file extension regular expression, causing the dot-extension check to fail. This bypass is most practical on Windows systems and could potentially lead to Remote Code Execution (RCE) if the underlying application is vulnerable.