GHSA-5GJ4-9GM7-2FX2

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

This is a parser differential and WAF inspection bypass affecting Coraza deployments that inspect JSON, including deployments using the current OWASP Core Rule Set.

An unauthenticated attacker can hide any malicious nested scalar value by adding a later top-level property whose literal dotted name collides with the path Coraza generates. Coraza and CRS inspect only the harmless replacement value, while backend JSON parsers retain and expose the malicious nested value.

The primitive is not limited to SQL injection. It removes the attacker-selected value from the collection evaluated by CRS, so it applies to nested values containing:

• SQL injection payloads
• operating-system command injection payloads
• cross-site scripting payloads
• server-side template injection payloads
• path traversal and local-file-inclusion payloads
• language- or framework-specific exploit strings
• forbidden application values inspected by custom SecLang rules

The PoC demonstrates a stock CRS SQL-injection detection bypass: the same backend-visible attack changes from a 403 denial to an allowed request solely by adding the colliding decoy property.

Applications that deserialize nested JSON objects are impacted. For example, Node.js applications using JSON.parse or JSON middleware and Go applications using encoding/json preserve the nested malicious value separately from the literal dotted property.

The final confidentiality, integrity, or availability impact depends on the backend vulnerability that CRS was deployed to mitigate. The Coraza security boundary failure itself is broad and reliable: arbitrary attacker-selected nested JSON values can be removed from normal rule inspection without making the JSON invalid or raising a body-processing error.

The remediation must make flattened paths unambiguous. Literal property-name separators must be escaped or encoded so that a nested path and a property containing dots cannot produce the same collection key. Coraza should also preserve multiple source values rather than silently overwriting a prior value when a generated-key collision occurs. A collision should never remove content from WAF inspection

The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.

GHSA-5GJ4-9GM7-2FX2 has a CVSS score of 5.8 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.8.1); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Use col.Add(key, value) instead of col.SetIndex(key, i, value). Add
always appends regardless of any index, so both a same-case collision (this
advisory's original case: one data key holding an ordered slice of values)
and a case-folding collision (two different data keys landing in the same
bucket) end up with every value preserved. The existing regression test for
the original collision
(TestJSONProcessRequestDottedKeyDoesNotHideNestedValue, which asserts a
specific value order) still passes unchanged, since a single data key's
own value order is unaffected by switching from indexed writes to appends. A
new TestJSONProcessRequestCaseVariantKeyDoesNotHideNestedValue (order
independent, since the two colliding values now come from different data
keys whose relative processing order is randomized) fails deterministically
against the pre-fix code (asserts 2 values, gets 1, every run) and passes
after the fix.

Full suite, build-tag matrix (coraza.no_memoize,
coraza.rule.multiphase_evaluation, coraza.rule.no_regex_multiline,
coraza.rule.case_sensitive_args_keys), and testing/coreruleset CRS
regression suite all pass. ADR-0058 has been amended with the same
follow-up note (still proposed, so amending in place is appropriate rather
than superseding it).

1. What is GHSA-5GJ4-9GM7-2FX2? GHSA-5GJ4-9GM7-2FX2 is a medium-severity improper input validation vulnerability in github.com/corazawaf/coraza/v3 (go), affecting versions >= 3.0.0, < 3.8.1. It is fixed in 3.8.1. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
2. How severe is GHSA-5GJ4-9GM7-2FX2? GHSA-5GJ4-9GM7-2FX2 has a CVSS score of 5.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/corazawaf/coraza/v3 are affected by GHSA-5GJ4-9GM7-2FX2? github.com/corazawaf/coraza/v3 (go) versions >= 3.0.0, < 3.8.1 is affected.
4. Is there a fix for GHSA-5GJ4-9GM7-2FX2? Yes. GHSA-5GJ4-9GM7-2FX2 is fixed in 3.8.1. Upgrade to this version or later.
5. Is GHSA-5GJ4-9GM7-2FX2 exploitable, and should I be worried? Whether GHSA-5GJ4-9GM7-2FX2 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether GHSA-5GJ4-9GM7-2FX2 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix GHSA-5GJ4-9GM7-2FX2? Upgrade github.com/corazawaf/coraza/v3 to 3.8.1 or later.

Other vulnerabilities in github.com/corazawaf/coraza/v3