Blogs & Stories

SpiderLabs Blog

Attracting more than a half-million annual readers, this is the security community's go-to destination for technical breakdowns of the latest threats, critical vulnerability disclosures and cutting-edge research.

ModSecurity Web Application Firewall - Commercial Rules Update(3)

We have released new commercial rules for ModSecurity Web Application Firewall (WAF) v2.9 and above. These rules' purpose is to protect against new emerging attacks that target vulnerabilities in public software.

For this release we would like to highlight the virtual patch for Apache Struts 2 REST Plugin XStream RCE - CVE-2017-9805. This vulnerability allows an attacker to perform a Remote Code Execution attack by abusing the XStreamHandler on the REST plugin when deserializing unfiltered and untrusted input.

This vulnerability ranks with a heightened level of risk as the skill level to exploit is quite low and there are known exploits in the wild allowing remote and unauthenticated attacks possibly leading to full server compromise by chaining it with other techniques.

ModSecurity Rules from Trustwave® SpiderLabs® include custom virtual patches for public vulnerabilities.

Release Summary

  • Easy Web Search 4.0 SQLi (2170067)
  • FTP Made Easy PRO 1.2 SQLi (2170068)
  • Joomla! Component Quiz Deluxe 3.7.4 SQLi (2170069)
  • Joomla! Component OSDownloads 1.7.4 SQLi (2170070)
  • Joomla! Component Photo Contest 1.0.2 SQLi (2170071)
  • Joomla! Component Price Alert 3.0.2 SQLi (2170072)
  • Joomla! Component Quiz Deluxe 3.7.4 SQLi (2170073)
  • Joomla! Component Responsive Portfolio 1.6.1 SQLi (2170074)
  • Apache Struts 2 REST Plugin XStream RCE (2170075)

Recent SpiderLabs Blog Posts