We have recently released new commercial rules for ModSecurity Web Application Firewall (WAF) v2.9 and above. These rules' purpose is to protect against new emerging attacks that target vulnerabilities in public software.
For this release we are highlighting virtual patches for Apache Tomcat RCE via JSP upload (CVE-2017-12615) and Apache Struts 2 - FreeMarker tag RCE (CVE-2017-12611). These issues could allow an attacker to perform Remote Code Execution attacks. The Apache Tomcat vulnerability abuses a poor default configuration on Tomcat 7.0.x that potentially allows arbitrary file uploads with malicious PUT requests. The Apache Struts vulnerability abuses a potentially common case of unintentional expressions in Freemarker tags (instead of string literals) leading to RCE conditions when abused.
These vulnerabilities ranks with a heightened level of risk as the skill level to exploit is quite low and there are known exploits in the wild allowing remote and unauthenticated attacks possibly leading to full server compromise by chaining it with other techniques.
ModSecurity Rules from Trustwave® SpiderLabs® include custom virtual patches for public vulnerabilities.
Release Summary
- Apache Tomcat RCE via JSP upload - CVE-2017-12615 (2170087)
- Apache Struts 2 - FreeMarker tag RCE - CVE-2017-12611 (2170086)
- Joomla! Component Survey Force Deluxe 3.2.4 SQLi (2170076)
- WordPress Plugin Content Timeline 4.4.2 SQLi (2170084)
- Multi Level Marketing SQLi service_detail.php (2170078)
- PHP Dashboards 4.4 SQLi (2170081)
- phpCollab 2.5.1 SQLi CVE-2017-6089 deletetopics.php (2170082)
- Multi Level Marketing SQLi news_detail (2170079)
- phpCollab 2.5.1 SQLi calendar/bookmarks SQLi (2170083)
- Multi Level Marketing SQLi event_detail.php (2170080)
- WordPress Plugin SMSmaster SQLi CVE-2017-14842 (2170085)
- Joomla! Component Zap Calendar Lite 4.3.4 SQLi (2170077)
