ꦫꦣꦺꦤ꧀ꦄꦤ꧀ꦠꦱꦺꦤ

PATH: opt / bitninja-waf3 / coreruleset / BitNinja

SecRule REQUEST_URI ".*/wp-admin/admin-ajax.php" \
  "id:401004, \
  phase:2,\
  rev:'1',\
  msg:'Wordpress Backdoor Protection. Arbitrary file upload in Fancy Product Designer. CVE-2021-24370 (%{TX.wp_admin_in})',\
  logdata:'Wordpress Backdoor Protection. Arbitrary file upload in Fancy Product Designer. CVE-2021-24370 (%{TX.wp_admin_in})',\
  block,\
  severity:CRITICAL,\
  chain"
SecRule ARGS_GET:action "fpd_custom_uplod_file" "chain"
SecRule REQUEST_BODY "(?:(?:<\?php|<\?)\s)" "setvar:tx.bn_inbound_found=+1"

SecRule &ARGS_POST "@gt 0" \
  "id:401002, \
  phase:2,\
  rev:'1',\
  msg:'Wordpress Backdoor Protection. Block HTTP POST method php calls for the themes directory (*/wp-includes/*.php)',\
  logdata:'Wordpress Backdoor Protection. Block HTTP POST method php calls for the themes directory (*/wp-includes/*.php)',\
  block,\
  severity:CRITICAL,\
    chain"
    SecRule REQUEST_URI ".*/wp-includes/.*.php" "setvar:tx.bn_inbound_found=+1"
SecRule &ARGS_POST "@gt 0" \
  "id:401001, \
  phase:2,\
  rev:'1',\
  msg:'Wordpress Backdoor Protection. Block HTTP POST method php calls for the themes directory (*/themes/*.php)',\
  logdata:'Wordpress Backdoor Protection. Block HTTP POST method php calls for the themes directory (*/themes/*.php)',\
  block,\
  severity:CRITICAL,\
    chain"
    SecRule REQUEST_URI ".*/themes/.*.php" "setvar:tx.bn_inbound_found=+1"
SecRule &ARGS_POST "@gt 0" \
  "id:401003, \
  phase:2,\
  rev:'1',\
  msg:'Wordpress Backdoor Protection. Block HTTP POST method php calls for the themes directory (*/wp-content/uploads/*.php)',\
  logdata:'Wordpress Backdoor Protection. Block HTTP POST method php calls for the themes directory (*/wp-content/uploads/*.php)',\
  block,\
  severity:CRITICAL,\
    chain"
    SecRule REQUEST_URI ".*/wp-content/uploads/.*.php" "setvar:tx.bn_inbound_found=+1"
SecRule REQUEST_URI ".*/wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php" \
  "id:401005, \
  phase:2,\
  rev:'1',\
  msg:'Wordpress Backdoor Protection. Arbitrary file upload in Fancy Product Designer. CVE-2021-24370',\
  logdata:'Wordpress Backdoor Protection. Arbitrary file upload in Fancy Product Designer. CVE-2021-24370',\
  block,\
  severity:CRITICAL,\
  chain"
SecRule REQUEST_BODY "(?:(?:<\?php|<\?)\s)" "setvar:tx.bn_inbound_found=+1"

SecRule REQUEST_METHOD "@rx ^POST$" \
    "id:401006,\
    chain,\
    phase:2,\
    rev:'1',\
    severity:critical,\
    t:none,\
    logdata:'Login attempt to WordPress with different referer',\
    msg:'Login attempt to WordPress with different referer'"
SecRule REQUEST_URI "@contains /wp-login.php" "chain,t:none"
SecRule REQUEST_HEADERS:Referer "!@contains %{SERVER_NAME}" "t:none,setvar:'tx.bn_inbound_found=+1'"

[-] 405-MAGENTO-REMOTE-EXECUTION-PROTECTION.conf [edit]
[-] 400030-status.conf [edit]
[+] ..
[-] 404-SCANNER-PROTECTION.conf [edit]
[-] malware-endpoints.data [edit]
[-] 419-REQUEST-BLOCKING-EVALUATION-BN.conf [edit]
[-] 402-DRUPAL-REMOTE-EXECUTION-PROTECTION.conf [edit]
[-] 401-WORDPRESS-BACKDOOR-PROTECTION.conf [edit]
[-] 410-OTHER-BN.conf [edit]
[-] 400-BITNINJA-INITIALIZATION.conf [edit]
[-] scripting-user-agents.data [edit]
[-] 104-TYPO3-MAGENTO-EXCLUSION-RULES.conf [edit]
[-] botnet-post-request.data [edit]
[-] 407-BOTNET-PROTECTION.conf [edit]
[-] 406-WORDPRESS-PLUGIN-VULNERABILITY-PROTECTION.conf [edit]
[-] 403-MODX-REVOLUTION-REMOETE-EXECUTION-PROTECTION.conf [edit]
[-] 408-SYMFONY-PROTECTION-BN.conf [edit]
[-] 409-ANTIMALWARE-PROTECTION-BN.conf [edit]
[-] web-shell-uri.data [edit]