We have released new commercial rules for ModSecurity Web Application Firewall (WAF) v2.9 and above. These rules' purpose is to protect against new emerging attacks that target vulnerabilities in public software.
For this release, we would like to highlight the virtual patch for Apache Struts 2 Showcase RCE - CVE-2017-9791. This vulnerability allows an attacker to perform an RCE attack with a malicious field value when using a Struts plugin with a Struts 1 action and the untrusted input is used as a part of the error message in an ActionMessage class.
This vulnerability ranks with a heightened level of risk as the skill level to exploit is quite low and there are known exploits in the wild allowing remote and unauthenticated attacks possibly leading to full server compromise by chaining it with other techniques.
ModSecurity Rules from Trustwave® SpiderLabs® complement the open-source OWASP ModSecurity Core Rules Set (CRS) by enhancing the basic payload protection offered by CRS. But CRS does not correlate specific attack vector locations (such as URL and parameters) from publicly disclosed vulnerabilities. This is where ModSecurity Rules from Trustwave® SpiderLabs® can help. These rules create custom virtual patches for public vulnerabilities.
Release Summary
- Added signature for Apache Struts 2 Showcase Remote Code Execution CVE-2017-9791 (2170055)
- Added signature for Joomla! Component BT Media categories parameter SQLi (2170047)
- Added signature for Joomla! Component Guru Pro Itemid parameter SQLi (2170048)
- Added signature for Joomla! Component PayPlans group_id parameter SQLi (2170049)
- Added signature for Joomla! Component Guru Pro Itemid parameter SQLi (2170050)
- Added signature for WordPress Plugin Event List 0.7.8 SQLi (2170051)
- Added signature for WordPress Plugin Huge-IT Video Gallery 2.0.4 SQLi (2170052)
- Added signature for WordPress Plugin Ultimate Product Catalogue 4.2.2 SQLi (2170053)
- Added signature for WordPress Plugin WP Jobs 1.5 SQLi CVE-2017-9603 (2170054)
