What's New in CRS4: An Update from the CRS Project
summary
CRS v4 introduces a plugin architecture and CRS sandbox for testing rules and paranoia levels, adds early blocking to stop requests after headers, and migrates rule exclusions into plugins; the release delays after a paid bug‑bounty finds dozens of bypasses that must be fixed. Detection improves for SSRF LFI RCE SQLi XSS and many web shells, tests become per‑rule positive/negative checks, the project drops PCRE dependence to support re2/hyperscan, and Coraza emerges as a viable Coraza alternative to ModSecurity.
AI-written summary · about
chapters (7)
- 0:00Start
- 7:40Article in Dark Reading: Transforming SQL Queries Bypasses WAF Security
- 8:49News from Planet CRS
- 19:56Major Changes for CRS v4
- 31:52Existing Plugins
- 38:43New Rules
- 40:59CRS v4 Release Plan
related talks
41mPractical OWASP CRS In High Security Settings
37mCore Rule Set for the Masses
53mOWASP Coraza: Open Source WAF for Cloud Native Service Mesh
29mFlagship Projects: ModSecurity Core Rule Set
40m'The Rise And Fall' Of ModSecurity And The OWASP Core Rule Set
32mOWASP Coraza - Web Application Firewall
35mFlagship Projects: CSRFGuard
46mIt is rough without a WAF