The OWASP CRS 4.23.0 release introduces new detection rules, cleans up false positives, and includes housekeeping improvements. Key updates include protections against Vite.js path traversal attacks, fake Mozilla user-agent requests, and PHP session file uploads, alongside several fixes for common false-positive triggers. Although the housekeeping changes may not be immediately noticeable, they improve processing efficiency and clean up redundant elements. Users already on recent CRS versions should find the upgrade low-risk and beneficial, while those on older releases are encouraged to upgrade for enhanced alert management and reduced noise
OWASP CRS 4.23.0 released
The latest OWASP CRS 4.23.0 release includes new detection rules, false-positive clean-ups, and housekeeping efforts that most users won't notice. The new rules include protection against Vite.js path traversal attacks, fake Mozilla user-agent blocks, and "trap" command block exploitation attempts, as well as PHP session file upload prevention. Additionally, the release fixes several common false-positives, such as ad and tracker cookie noise and malformed SSRF URLs. Overall, the update is considered a low-risk upgrade for users already on recent CRS versions and a recommended upgrade for those on older releases.
