GHSA-5gj4-9gm7-2fx2: Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspection

Coraza’s JSON body processor converts nested JSON properties into dot-separated ARGS_POST names without escaping dots contained in literal property names. Two distinct JSON properties can therefore collapse into the same Coraza variable

An unauthenticated attacker can place a malicious value in a nested property and then overwrite only Coraza’s representation with a harmless dotted property:

{
"account": {
"role": "1' OR '1'='1"
},
"account.role": "safe"
}

Coraza stores both properties as ARGS_POST:json.account.role; the later value safe replaces the SQL-injection value. Standard backend JSON parsers preserve the two distinct properties and expose the malicious nested value as account.role.

This bypasses the complete current OWASP Core Rule Set (CRS) for the hidden value. In the supplied control-pair PoC, CRS v4.25 blocks the nested SQL-injection value with rule 949110. Adding the dotted decoy makes the same attack pass with no interruption, while Go’s standard JSON parser still returns the malicious nested value.