IT SBIT Services
Schneeberger
DEEN
CVE tracker

OWASP Core Rule Set: WAF bypass via XML attribute values

CVE-2026-62971High 7.2

← All vulnerabilities

Summary

The OWASP Core Rule Set (CRS) attack detection rules in several families inspect only XML element text, not XML attribute values. An attacker can place attack payloads such as SQL injection or XSS inside XML attributes of a request body and bypass detection in a web application firewall that uses these rules, at every paranoia level. The CRS maintainers verified the bypass in a local test instance and in the public CRS sandbox. The vulnerability is in the WAF rule set, not in the protected application itself.

Affected

  • CRS versions before 3.3.10, before 4.25.1 and before 4.28.0, as listed in the CVE record
  • Affected rule families: 921, 930, 931, 932, 933, 934, 941, 942 and 943 (about 159 rules); family 944 is not affected

Fixed in

  • 4.28.0 (main branch)
  • 4.25.1 (v4 LTS)
  • 3.3.10 (v3 LTS, end of life)

Workaround

  • On the 4.25.1 and 3.3.10 LTS branches, the fix is behind an opt-in setting: enable the SecAction that sets tx.crs_xml_attr_inspect=1 in crs-setup.conf
  • Verify after the update that the setting is active, as an open CRS issue reports that the LTS default may not fully enable the fix
  • Unknown: no other workaround is documented

Exploitation

Unknown. The bypass was verified by the researchers with proof-of-concept payloads, but no active exploitation has been reported in the sources.

Our recommendation

  • Update CRS to 4.28.0 or the current 4.x release, or to the 4.25.x LTS line; do not use 3.3.x, which is end of life
  • On LTS branches, enable the opt-in XML attribute inspection setting and check that it is active
  • Check whether your WAF uses CRS and which version is deployed
  • Monitor WAF logs for suspicious payloads inside XML attributes and test the rules after the update

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:26.

Original description (NVD)

The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (generic), 941 (XSS), 942 (SQLi), and 943 (session-fixation) families inspect XML request bodies via the XPath expression XML:/*. That expression matches only element text nodes — it does not match XML attribute values. As a result, an attacker who places an attack payload inside an XML attribute (e.g. <a href="javascript:alert(1)=window.name"></a> or <a value="' OR 1=1 --"></a>) bypasses CRS detection entirely. This is verified empirically against a local CRS test instance and against the public CRS sandbox. The bypass affects approximately 159 rules across 9 rule files and applies at every paranoia level (PL1 through PL4), since the variable list is more or less shared across PLs. The 944 (Java) family is the only one that correctly includes XML://@* in addition to XML:/* and is therefore unaffected. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0.

NVD references (5)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed