CVE-2026-114099

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.

Summary

Coraza's JSON body processor converts nested JSON properties into dot-separated ARGS_POST names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable

An unauthenticated attacker can place a malicious value in a nested property and then overwrite only Coraza's representation with a harmless dotted property:

{
  "account": {
    "role": "1' OR '1'='1"
  },
  "account.role": "safe"
}

Coraza stores both properties as ARGS_POST:json.account.role; the later value safe replaces the SQL-injection value. Standard backend JSON parsers preserve the two distinct properties and expose the malicious nested value as account.role.

This bypasses the complete current OWASP Core Rule Set (CRS) for the hidden value. In the supplied control-pair PoC, CRS v4.25 blocks the nested SQL-injection value with rule 949110. Adding the dotted decoy makes the same attack pass with no interruption, while Go's standard JSON parser still returns the malicious nested value.

Details

The affected component is the JSON body processor in internal/bodyprocessors/json.go.

readJSON creates a single map[string]string and begins every generated path with json:

func readJSON(s string, maxRecursion int) (map[string]string, error) {
    res := make(map[string]string)
    key := []byte("json")

    json := gjson.Parse(s)
    err := readItems(json, key, maxRecursion, res)
    // ...
}

Source: internal/bodyprocessors/json.go, lines 81-94.

For every object level, readItems appends a literal dot followed by the unescaped property name:

prevParentLength := len(objKey)
objKey = append(objKey, '.')
if key.Type == gjson.String {
    objKey = append(objKey, key.Str...)
}

Source: internal/bodyprocessors/json.go, lines 111-120.

Scalar values are stored in the map using the resulting flattened string:

res[string(objKey)] = val

Source: internal/bodyprocessors/json.go, lines 122-145.

This produces a collision:

Nested property:       {"account":{"role":"ATTACK"}}
Generated Coraza key:  json.account.role

Literal dotted key:    {"account.role":"SAFE"}
Generated Coraza key:  json.account.role

Because both values use the same Go map key, the property appearing later in the JSON document overwrites the earlier value. The malicious value no longer exists anywhere in the ordinary ARGS_POST collection.

ProcessRequest subsequently copies only the final map entries into ARGS_POST:

data, err := readJSON(ss, bpo.RequestBodyRecursionLimit)
for key, value := range data {
    col.SetIndex(key, 0, value)
}

Source: internal/bodyprocessors/json.go, lines 29-39.

The JSON remains valid, so Coraza does not set REQBODY_ERROR. A normal backend parser does not flatten property names and therefore keeps the nested account.role value separate from the literal top-level "account.role" property.

Coraza's recommended configuration enables JSON processing, and OWASP CRS rules inspect the generated argument collection. This makes the issue reachable in a standard Coraza and CRS deployment.

The bypass was reproduced against CRS v4.25 under all of the following…

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.

Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal dots, so distinct properties collide. Unauthenticated attackers can add a later dotted property such as account.role that overwrites a malicious nested value, hiding SQL injection payloads from OWASP CRS rules while backends still receive them.

Summary

Coraza's JSON body processor converts nested JSON properties into dot-separated ARGS_POST names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable

An unauthenticated attacker can place a malicious value in a nested property and then overwrite only Coraza's representation with a harmless dotted property:

{
  "account": {
    "role": "1' OR '1'='1"
  },
  "account.role": "safe"
}

Coraza stores both properties as ARGS_POST:json.account.role; the later value safe replaces the SQL-injection value. Standard backend JSON parsers preserve the two distinct properties and expose the malicious nested value as account.role.

This bypasses the complete current OWASP Core Rule Set (CRS) for the hidden value. In the supplied control-pair PoC, CRS v4.25 blocks the nested SQL-injection value with rule 949110. Adding the dotted decoy makes the same attack pass with no interruption, while Go's standard JSON parser still returns the malicious nested value.

Details

The affected component is the JSON body processor in internal/bodyprocessors/json.go.

readJSON creates a single map[string]string and begins every generated path with json:

func readJSON(s string, maxRecursion int) (map[string]string, error) {
    res := make(map[string]string)
    key := []byte("json")

    json := gjson.Parse(s)
    err := readItems(json, key, maxRecursion, res)
    // ...
}

Source: internal/bodyprocessors/json.go, lines 81-94.

For every object level, readItems appends a literal dot followed by the unescaped property name:

prevParentLength := len(objKey)
objKey = append(objKey, '.')
if key.Type == gjson.String {
    objKey = append(objKey, key.Str...)
}

Source: internal/bodyprocessors/json.go, lines 111-120.

Scalar values are stored in the map using the resulting flattened string:

res[string(objKey)] = val

Source: internal/bodyprocessors/json.go, lines 122-145.

This produces a collision:

Nested property:       {"account":{"role":"ATTACK"}}
Generated Coraza key:  json.account.role

Literal dotted key:    {"account.role":"SAFE"}
Generated Coraza key:  json.account.role

Because both values use the same Go map key, the property appearing later in the JSON document overwrites the earlier value. The malicious value no longer exists anywhere in the ordinary ARGS_POST collection.

ProcessRequest subsequently copies only the final map entries into ARGS_POST:

data, err := readJSON(ss, bpo.RequestBodyRecursionLimit)
for key, value := range data {
    col.SetIndex(key, 0, value)
}

Source: internal/bodyprocessors/json.go, lines 29-39.

The JSON remains valid, so Coraza does not set REQBODY_ERROR. A normal backend parser does not flatten property names and therefore keeps the nested account.role value separate from the literal top-level "account.role" property.

Coraza's recommended configuration enables JSON processing, and OWASP CRS rules inspect the generated argument collection. This makes the issue reachable in a standard Coraza and CRS deployment.

The bypass was reproduced against CRS v4.25 under all of the following…

Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection in github.com/corazawaf/coraza