-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues in input processing: 1) Case-sensitive regex patterns in entity detection rules (shown in dwisiswant0/cwa-filter-rules commit adding (?i) flag) 2) Lack of special character stripping before pattern matching (fixed by adding removeSpecialChars in teler-waf's analyze.go). The checkCommonWebAttack() function was directly responsible for processing request inputs using these incomplete sanitization mechanisms, making it the vulnerable entry point. The commit 6e1b0e19b8adc1bbc3513a986025d4adf88d59f8 shows these fixes were applied specifically in this function's processing flow.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/kitabisa/teler-waf | go | < 0.2.0 | 0.2.0 |
Ongoing coverage of React2Shell