We have just released new commercial rules for ModSecurity Web Application Firewall (WAF) v2.9 and above. These rules' purpose is to protect against new emerging attacks that target vulnerabilities in public software.
For this release we would like to highlight the virtual patch for Joomla! 3.7.0 SQL Injection - CVE-2017-8917. In a few words this vulnerability lies in the fact that com_fields, a newly added Joomla! component, shares some admin "views" and ended up being introduced in a way that allows unsanitized user input to be concatenated to an ORDER BY SQL statement leading to SQL Injection.
This vulnerability ranks with a severity of 8 in CVSS. Also the skill level to exploit it is quite low and can be remotely and publicly exploited possibly leading to full server compromise by chaining it with other attacks.
ModSecurity Rules from Trustwave® SpiderLabs® complement the open source OWASP ModSecurity Core Rules Set (CRS) by enhancing the basic payload protection offered by CRS. But CRS does not correlate specific attack vector locations (such as URL and parameters) from publicly disclosed vulnerabilities. This is where ModSecurity Rules from Trustwave® SpiderLabs® can help. These rules create custom virtual patches for public vulnerabilities.
Release Summary
- Added signature for Joomla! 3.7.0 SQLi - CVE-2017-8917 (2170036)
- Added signature for Permalink injection vulnerability in MantisBT - CVE-2017-7620 (2170037)
- Added signature for Arbitrary password reset in MantisBT 2.3.0 - CVE-2017-7615 (2170038)
- Added signature for WordPress Plugin Tribulant Newsletters 4.6.4.2 XSS (2170039)
- Added signature for WordPress Plugin Tribulant Newsletters 4.6.4.2 Admin-Ajax XSS (2170040)
- Added signature for WordPress Plugin Tribulant Newsletters 4.6.4.2 newsletters-history XSS (2170041)
- Added signature for Joomla! Component Myportfolio 3.0.2 pid parameter SQLi (2170042)
- Added signature for Joomla! Component Payage 2.05 aid parameter SQLi (2170043)
- Added signature for Piwigo Plugin Facetag 0.0.3 ws.php changeTag SQLi (2170044)
- Added signature for Piwigo Plugin Facetag 0.0.3 ws.php changeTag XSS (2170045)
- Added signature for Piwigo Plugin Facetag 0.0.3 ws.php ListTag SQLi (2170046)
