Overview for rules released by Trustwave SpiderLabs in December for ModSecurity Commercial Rules package. The rules are available for versions 2.9.x and 3.x of ModSecurity.
ModSecurity Commercial Rules detect attacks or classes of attacks on web applications and their components as well as provide virtual patches for public vulnerabilities.
Release Summary
WordPress Plugin Booking Calendar < 8.9.2 - Reflected XSS CVE-2021-25040
WordPress Plugin Booster for Woocommerce < 5.4.9 - Reflected XSS in PDF Invoicing Module CVE-2021-24999
WordPress Plugin Booster for WooCommerce < 5.4.9 - Reflected XSS in General Module CVE-2021-25000
WordPress Plugin Booster for WooCommerce < 5.4.9 - Reflected XSS in Product XML Feeds Module CVE-2021-25001
WordPress Plugin Video Conferencing with Zoom < 3.8.16 - Reflected XSS
WordPress Plugin Contact Form & Lead Form Elementor Builder < 1.6.4 XSS CVE-2021-24967
WordPress Plugin Download Manager < 3.2.22 - Stored XSS CVE-2021-24969
WordPress Plugin RSS Aggregator < 4.19.3 - Stored XSS CVE-2021-24988
WordPress Plugin WooCommerce Multivendor Marketplace < 3.4.12 - Unauthenticated SQLi CVE-2021-24849
WordPress Plugin Ni WooCommerce Custom Order Status < 1.9.7 - SQLi CVE-2021-24846
WordPress Plugin Paid Memberships Pro < 2.6.6 - Reflected XSS CVE-2021-24979
WordPress Plugin Icegram < 2.0.5 - Reflected XSS CVE-2021-24941
WordPress Plugin Backup and Restore 1.0.3 - Arbitrary File Deletion
How to Update
All the rules released this month are available for download and can be configured using the ModSecurity Dashboard. The rules are associated with the default profile and enabled for all licensed servers. To verify the rules were successfully downloaded by ModSecurity, log in to the ModSecurity Dashboard and verify the server "Last seen" date, which indicates the last successful download for the specified server.
