Web Application Security – ModSecurity Commercial Rules Rules, Update for March 2018

The SpiderLabs® WAF team have released commercial rules updates for ModSecurity Web Application Firewall (WAF) v2.9 and above. These rules' purpose is to protect against new emerging attacks that target vulnerabilities in public software.

For this release we are highlighting virtual patches for a Remote Code Execution on Drupal 7.x/8.x  SA-CORE-2018-002 ( CVE-2018-7600). This issue also known as "Drupalgeddon2" could allow an attacker to perform Remote Code Execution attacks.

The issue happens due to Drupal usually accepting parameters as array objects. This allows a user passing an array object to Drupal with a keyname containing a forms "payload". The vulnerability leads Drupal to blindly process the malicious payload. The Drupal forms API reference suggests that a number of keynames could be used as payloads, depending on the payload the application could be compromised, and Remote Code Execution is possible. SpiderLabs WAF Research Team have developed a virtual patch for Commercial Rules customers since the day that this vulnerability became widely public.

Even though we are currently not aware of publicly working PoC code and we have yet to see exploitation in the wild, this vulnerability still ranks with the highest level of risk as remote and unauthenticated attacks is possible leading to full server compromise by chaining it with other techniques.

ModSecurity Rules from Trustwave SpiderLabs include custom virtual patches for public vulnerabilities.

Release Summary

• Drupal 7.x/8.x RCE CVE-2018-7600(2180033)
• Joomla! Component Advertisement Board 3.1.0 SQLi CVE-2018-6398(2180034)
• Joomla! Component Aist 2.0 SQLi CVE-2018-5993(2180035)
• Joomla! Component AllVideos Reloaded 1.2.x SQLi CVE-2018-5990(2180036)
• Joomla! Component DT Register 3.2.7 SQLi CVE-2018-6584(2180037)
• Joomla! Component Fastball 2.5 - SQLi CVE-2018-6373(2180038)
• Joomla! Component Form Maker 3.6.12 SQLi CVE-2018-5991(2180039)
• Joomla! Component Gallery WD 1.3.6 SQLi CVE-2018-5981(2180040)
• Joomla! Component SIGE 3.2.3 XSS CVE-2017-16356(2180041)
• Joomla! Component Google Map Landkarten 4.2.3 SQLi CVE-2018-6396(2180042)
• Joomla! Component File Download Tracker 3.0 SQLi CVE-2018-6004(2180043)
• Drupal 7.x/8.x RCE CVE-2018-7600(Parameters) (2180044)