CVE-2023-40586: Insufficient Information (NVD-CWE-noinfo)
value: OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`. This issue was patched in version 3.0.1.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 7.5
Published: 2023-08-25T21:15Z
Repository: https://github.com/corazawaf/coraza
Language: Go
Files changed: internal/bodyprocessors/multipart.go, internal/bodyprocessors/multipart_test.go
Commit date: 2023-06-25 18:16:26 +0200
Commit message: Merge pull request from GHSA-c2pj-v37r-2p6h


Diff: diff --git a/internal/bodyprocessors/multipart.go b/internal/bodyprocessors/multipart.go
index efdcf62..1efea69 100644
--- a/internal/bodyprocessors/multipart.go
+++ b/internal/bodyprocessors/multipart.go
@@ -5,11 +5,10 @@ package bodyprocessors
 
 import (
 	"errors"
 	"fmt"
 	"io"
-	"log"
 	"mime"
 	"mime/multipart"
 	"os"
 	"strings"
 
@@ -23,11 +22,11 @@ type multipartBodyProcessor struct{}
 func (mbp *multipartBodyProcessor) ProcessRequest(reader io.Reader, v plugintypes.TransactionVariables, options plugintypes.BodyProcessorOptions) error {
 	mimeType := options.Mime
 	storagePath := options.StoragePath
 	mediaType, params, err := mime.ParseMediaType(mimeType)
 	if err != nil {
-		log.Fatalf("failed to parse media type: %s", err.Error())
+		return err
 	}
 	if !strings.HasPrefix(mediaType, "multipart/") {
 		return errors.New("not a multipart body")
 	}
 	mr := multipart.NewReader(reader, params["boundary"])
diff --git a/internal/bodyprocessors/multipart_test.go b/internal/bodyprocessors/multipart_test.go
index 4a0ffef..5173a5c 100644
--- a/internal/bodyprocessors/multipart_test.go
+++ b/internal/bodyprocessors/multipart_test.go
@@ -75,5 +75,22 @@ Content-Type: text/html
 		if (h[0] != header1 && h[0] != header2) || (h[1] != header1 && h[1] != header2) {
 			t.Fatalf("Got invalid multipart headers")
 		}
 	}
 }
+
+func TestInvalidMultipartCT(t *testing.T) {
+	payload := strings.TrimSpace(`
+-----------------------------9051914041544843365972754266
+Content-Disposition: form-data; name="text"
+
+text default
+-----------------------------9051914041544843365972754266
+`)
+	mp := multipartProcessor(t)
+	v := corazawaf.NewTransactionVariables()
+	if err := mp.ProcessRequest(strings.NewReader(payload), v, plugintypes.BodyProcessorOptions{
+		Mime: "multipart/form-data; boundary=---------------------------9051914041544843365972754266; a=1; a=2",
+	}); err == nil {
+		t.Error("multipart processor should fail for invalid content-type")
+	}
+}

Vulnerable code: 	"log"
		log.Fatalf("failed to parse media type: %s", err.Error())
Fixed code: 		return err

func TestInvalidMultipartCT(t *testing.T) {
	payload := strings.TrimSpace(`
-----------------------------9051914041544843365972754266
Content-Disposition: form-data; name="text"

text default
-----------------------------9051914041544843365972754266
`)
	mp := multipartProcessor(t)
	v := corazawaf.NewTransactionVariables()
	if err := mp.ProcessRequest(strings.NewReader(payload), v, plugintypes.BodyProcessorOptions{
		Mime: "multipart/form-data; boundary=---------------------------9051914041544843365972754266; a=1; a=2",
	}); err == nil {
		t.Error("multipart processor should fail for invalid content-type")
	}
}