Exploitation Summary
EIP tracks 6 public exploits for CVE-2026-21876. PoCs published by anonimicerum, XiaomingX, daytriftnewgen.
AI-analyzed exploit summary This exploit demonstrates a firewall bypass in Core Rule Set (CRS) versions < 4.22.0/3.3.8 by encoding form data in UTF-7 and converting it to multipart, evading detection rules. It acts as a proxy to forward malicious requests to a target upstream server.
Description
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTIPART_PART_HEADERS`), the capture variables (`TX:0`, `TX:1`) get overwritten with each iteration. Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. Versions 4.22.0 and 3.3.8 patch the issue.
Exploits (6)
This exploit demonstrates a firewall bypass in Core Rule Set (CRS) versions < 4.22.0/3.3.8 by encoding form data in UTF-7 and converting it to multipart, evading detection rules. It acts as a proxy to forward malicious requests to a target upstream server.
This repository contains a functional PoC for CVE-2026-21876, demonstrating a WAF bypass in OWASP CRS via a crafted multipart/form-data request with a non-standard charset (utf-7). The exploit leverages improper charset handling to bypass input validation.
This repository contains a proof-of-concept for CVE-2026-21876, demonstrating a WAF bypass via a multipart/form-data charset manipulation technique. The exploit leverages a non-standard charset (utf-7) to encode malicious payloads, bypassing OWASP CRS WAF rules.
This repository contains a functional PoC for CVE-2026-21876, demonstrating a WAF bypass in OWASP CRS via a crafted multipart/form-data request with a non-standard charset (utf-7). The exploit leverages a vulnerability where the WAF fails to properly validate the charset, allowing malicious payloads to bypass security checks.
This repository provides a lab environment for CVE-2026-21876, demonstrating an XSS vulnerability in a Flask application. The exploit involves crafting a malicious multipart/form-data request to bypass WAF protections and execute arbitrary JavaScript.
This repository contains a functional PoC for CVE-2026-21876, demonstrating a WAF bypass in OWASP CRS via a crafted multipart/form-data request using a non-standard charset (utf-7) to evade detection. The included Docker setup provides a test environment with a vulnerable OWASP ModSecurity CRS instance and a Flask backend to validate the bypass.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N