[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAPmip_xVPZ_mFkTUjGd=k_3K222BQxPhySy1ei2VieqBp=pBng@mail.gmail.com>
Date: Thu, 16 Apr 2026 15:37:21 -0400
From: cyber security <cs7778503@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: [CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability
Deep analysis by US confirm, that using CVE-2026-33691, in any
platform wheter windows or linux or mac, you can bypass unpatched CRS
and use CVE-2015-10138
as confirmed, as we see in that line
```
1 // Lines 493-498 of public/includes/UploadHandler.php
2 protected function trim_file_name($name, $type = null, $index =
null, $content_range = null) {
3 // Remove path information and dots around the filename...
4 // Also remove control characters and spaces (\x00..\x20)
around the filename:
5 $name = trim(basename(stripslashes($name)), ".\x00..\x20");
6 // ...
7 }
```
It unlocks the old CVE-2015-10138 and an attacker get RCE if WAFs are
not patched, that unlocks the old vuln power against a modern WAF,
most peoples rely only on the WAF alone and `Work The Flow File
Upload` plugin is never patched and even run **EOL** that is very
common, That is the danger, after that confirm, we see one wordpress
plugin confirmed trims whitespaces from uploaded files
On Sun, Mar 29, 2026 at 3:33 AM cyber security <cs7778503@...il.com> wrote:
>
> A vulnerability was identified in OWASP CRS where whitespace padding
> in filenames can bypass file upload extension checks, allowing uploads
> of dangerous files such as .php, .phar, .jsp, and .jspx. This issue
> has been assigned CVE‑2026‑33691.
>
> Impact: Attackers may evade CRS protections and upload web shells
> disguised with whitespace‑padded extensions. Exploitation is most
> practical on Windows backends that normalize whitespace in filenames
> before execution, In linux harder because it require a backend that
> use like `.strip()` and `.trim()` and other whitespace trimming
> methods depending on the language here vulnerable to that or the
> webserver strip whitespaces or the backend on general, If not they not
> vulnerable to that.
>
> Fix: Patched in CRS v3.3.9, v4.25.x LTS, and v4.8.x. Security fixes
> are always backported to supported branches.
>
> References:
>
> Full advisory: https://github.com/coreruleset/coreruleset/security/advisories/GHSA-rw5f-9w43-gv2w
>
> Credits: Reported by RelunSec (aka @HackingRepo on Github).
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
