From 4ce02663339b6b0976b69f041904b8610dd90cea Mon Sep 17 00:00:00 2001 From: jvoisin Date: Thu, 22 Feb 2018 10:53:15 +0100 Subject: Refactor a bit our rules --- config/default.rules | 1 - config/examples.rules | 41 ------------------------------------ config/rips.rules | 35 +++++++++++++++++++++++++++--- src/tests/example_configuration.phpt | 20 ------------------ 4 files changed, 32 insertions(+), 65 deletions(-) delete mode 100644 config/examples.rules delete mode 100644 src/tests/example_configuration.phpt diff --git a/config/default.rules b/config/default.rules index 88398c1..b52ae4c 100644 --- a/config/default.rules +++ b/config/default.rules @@ -1,6 +1,5 @@ # Harden the `chmod` function sp.disable_function.function("chmod").param("mode").value_r("^[0-9]{2}[67]$").drop(); -sp.disable_function.function("chmod").param("mode").value_r("o\\+w$").drop(); # Prevent various `mail`-related vulnerabilities sp.disable_function.function("mail").param("additional_parameters").value_r("\\-").drop(); diff --git a/config/examples.rules b/config/examples.rules deleted file mode 100644 index 664a67a..0000000 --- a/config/examples.rules +++ /dev/null @@ -1,41 +0,0 @@ -# Restrict system calls to specific file -sp.disable_function.function("system").filename("/update.php").allow(); -sp.disable_function.function("system").drop(); - - -# Restrict system calls to specific file with a specific hash -sp.disable_function.function("system").filename("/update.php").hash("d27c6c5686bc129716b6aac8dfefe2d519a80eb6cc144e97ad42c728d423eed0").allow(); -sp.disable_function.function("system").drop(); - - -# AbanteCart 1.2.8 - Multiple SQL Injections -sp.disable_function.filename("/core/lib/language_manager.php").function("ALanguageManager>_clone_language_rows").param("from_language").value_r("[^0-9]").drop(); -sp.disable_function.filename("/admin/model/tool/backup.php").function("ModelToolBackup>createBackupTask").param("data[table_list]").value_r("'").drop(); - - -# Redaxo 5.2.0: Remote Code Execution via CSRF -# See for details -sp.disable_function.filename("/redaxo/src/addons/structure/pages/linkmap.php").function("substr").param("string").value_r("\"").drop(); - - -# Guest Post: Vtiger 6.5.0 - SQL Injection -sp.disable_function.filename("/modules/Calendar/Activity.php").function("save_module").param("query").value_r("[^0-9;]").drop(); - - -# The State of Wordpress Security -# All In One WP Security & Firewall -sp.disable_function.filename("/admin/wp-security-dashboard-menu.php").function("render_tab3").var("_REQUEST[tab]").value_r("\"").drop(); - - -# PHPKit 1.6.6: Code Execution for Privileged Users -sp.disable_function.filename("/pkinc/func/default.php").function("move_uploaded_file").param("destination").value_r("\\.ph\\.+$").drop(); - - -# Coppermine 1.5.42: Second-Order Command Execution -sp.disable_function.filename("/include/imageobject_im.class.php").function("exec").var("CONFIG[im_options]").value_r("[^a-z0-9]").drop(); -sp.disable_function.filename("/forgot_passwd.php").function("cpg_db_query").var("CLEAN[id]").value_r("[^a-z0-9]").drop(); - - -# CVE-2017-1001000 - https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html -sp.disable_function.filename("/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_GET[id]").value_r("[^0-9]").drop(); -sp.disable_function.filename("/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_POST[id]").value_r("[^0-9]").drop(); diff --git a/config/rips.rules b/config/rips.rules index 9497528..52e3f27 100644 --- a/config/rips.rules +++ b/config/rips.rules @@ -1,4 +1,33 @@ -sp.disable_function.function("define").filename_r("/static_pages/index.php").var("$_SERVER[PHP_SELF]").value_r("\"").drop(); -sp.disable_function.function("ModelToolBackup::createBackupTask").filename_r("/admin/model/tool/backup.php").param("data[table_list]").value_r("'").drop(); -sp.disable_function.function("ALanguageManager::_clone_language_rows").filename_r("/core/lib/language_manager.php").param("from_language").value_r("[^0-9]").drop(); +# AbanteCart 1.2.8 - Multiple SQL Injections +sp.disable_function.function("define").filename_r("/static_pages/index\\.php$").var("$_SERVER[PHP_SELF]").value_r("\"").drop(); +sp.disable_function.function("ModelToolBackup::createBackupTask").filename_r("/admin/model/tool/backup\\.php$").param("data[table_list]").value_r("'").drop(); +sp.disable_function.function("ALanguageManager::_clone_language_rows").filename_r("/core/lib/language_manager\\.php$").param("from_language").value_r("[^0-9]").drop(); + + +# Redaxo 5.2.0: Remote Code Execution via CSRF +# See for details +sp.disable_function.filename("/redaxo/src/addons/structure/pages/linkmap.php").function("substr").param("string").value_r("\"").drop(); + + +# Guest Post: Vtiger 6.5.0 - SQL Injection +sp.disable_function.filename("/modules/Calendar/Activity.php").function("save_module").param("query").value_r("[^0-9;]").drop(); + + +# The State of Wordpress Security +# All In One WP Security & Firewall +sp.disable_function.filename("/admin/wp-security-dashboard-menu.php").function("render_tab3").var("_REQUEST[tab]").value_r("\"").drop(); + + +# PHPKit 1.6.6: Code Execution for Privileged Users +sp.disable_function.filename("/pkinc/func/default.php").function("move_uploaded_file").param("destination").value_r("\\.ph\\.+$").drop(); + + +# Coppermine 1.5.42: Second-Order Command Execution +sp.disable_function.filename("/include/imageobject_im.class.php").function("exec").var("CONFIG[im_options]").value_r("[^a-z0-9]").drop(); +sp.disable_function.filename("/forgot_passwd.php").function("cpg_db_query").var("CLEAN[id]").value_r("[^a-z0-9]").drop(); + + +# CVE-2017-1001000 - https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html +sp.disable_function.filename("/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_GET[id]").value_r("[^0-9]").drop(); +sp.disable_function.filename("/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php").function("register_routes").var("_POST[id]").value_r("[^0-9]").drop(); diff --git a/src/tests/example_configuration.phpt b/src/tests/example_configuration.phpt deleted file mode 100644 index 6c2e82d..0000000 --- a/src/tests/example_configuration.phpt +++ /dev/null @@ -1,20 +0,0 @@ ---TEST-- -Shipped configuration ---SKIPIF-- - ---INI-- -sp.configuration_file={PWD}/../../config/examples.rules ---FILE-- - yes') !== FALSE) { - echo "win"; -} else { - echo "lose"; -} -?> ---EXPECTF-- -win -- cgit v1.3