Web Application Security – ModSecurity Commercial Rules, Update for June 2020

Overview for rules released by Trustwave SpiderLabs in June for ModSecurity Commercial Rules package. The rules are available for versions 2.9.x and 3.x of ModSecurity.

ModSecurity Commercial Rules detect attacks or classes of attacks on web applications and their components as well as provide virtual patches for public vulnerabilities.

Release Summary

• WordPress Plugin JobSearch < 1.5.1 XSS
• WordPress Plugin Careerfy < 3.9.0 XSS
• WordPress Plugin Newspaper < 10.3.4 XSS
• WordPress Plugin AdRotate < 5.8.4 SQLi
• WordPress Plugin Delightful Downloads <= 1.6.6 Directory Traversal CVE-2017-1000170
• WordPress Plugin KingComposer < 2.9.4 Directory Traversal
• WordPress Plugin KingComposer < 2.9.4 XSS
• WordPress Plugin Xenon Theme < 1.3 XSS CVE-2020-14010
• WordPress Plugin Rank Math 0.9 - 1.0.42.1 Authentication Bypass
• WordPress Plugin Testimonial Rotator < 3.0.3 XSS
• WordPress Plugin SportsPress < 2.7.2 XSS CVE-2020-13892
• WordPress Plugin Elementor Page Builder < 2.9.10 XSS CVE-2020-13864
• WordPress Plugin Blog2Social < 6.3.1 SQLi
• WordPress Plugin Page Builder: PageLayer < 1.1.2 pagelayer_update_content XSS
• WordPress Plugin Page Builder: PageLayer < 1.1.2 pagelayer-address XSS
• WordPress Plugin Final Tiles Gallery < 3.4.19 XSS CVE-2020-14962
• Joomla! Plugin J2 Store 3.3.11 SQLi
• WordPress <= 5.2.3 Directory traversal
• WordPress Plugin VRView <= 1.1.3/VRView library < 2.0.2/WP-VR-view <= 1.6 XSS
• WordPress Plugin Team Members < 5.0.4 XSS
• WordPress Plugin Form Maker 5.4.1/Form Maker by 10Web <= 1.13.35 SQLi
• WordPress Plugin MapPress Maps Pro < 2.54.6 RCE CVE-2020-12675
• WordPress Plugin MapPress Maps Pro < 2.53.9 RCE CVE-2020-12077
• WordPress Plugin Official MailerLite Sign Up Forms < 1.4.5 SQLi
• WordPress Plugin Add-on SweetAlert Contact Form 7 < 1.0.8 XSS
• WordPress Plugin Drag and Drop File Upload Contact Form 1.3.3.2 RCE CVE-2020-12800
• Joomla! Plugin XCloner Backup 3.5.3 LFI
• WordPress Plugin Multi-Scheduler 1.0.0 CSRF
• WordPress Plugin ThirstyAffiliates < 3.9.3 XSS
• WordPress Plugin Photo Gallery by 10Web <1.5.55 SQLi

How to Update

All the rules released this month are available for download and can be configured using the ModSecurity Dashboard. The rules are associated with the default profile and enabled for all licensed servers. To verify the rules were successfully downloaded by ModSecurity, log in to the ModSecurity Dashboard and verify the server "Last seen" date, which indicates the last successful download for the specified server.