| Current File : //26_Apps_WordPress.conf |
# ---------------------------------------------------------------
# Comodo ModSecurity Rules
# Copyright (C) 2022 Comodo Security solutions All rights reserved.
#
# The COMODO SECURITY SOLUTIONS Mod Security Rule Set is distributed under
# THE COMODO SECURITY SOLUTIONS END USER LICENSE AGREEMENT,
# Please see the enclosed LICENCE file for full details.
# ---------------------------------------------------------------
# This is a FILE CONTAINING CHANGED or MODIFIED RULES FROM THE:
# OWASP ModSecurity Core Rule Set (CRS)
# ---------------------------------------------------------------
SecRule &TX:WordPress "@eq 0" \
"id:225250,msg:'COMODO WAF: Track unauthenticated request in WordPress||%{tx.domain}|%{tx.mode}|2',phase:2,pass,nolog,t:none,skipAfter:'WP_Skip_URF_225040',rev:1,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule &TX:XSS_SQLi "@eq 0" \
"id:225230,msg:'COMODO WAF: Track same forbidden symbols to Ignore signature for WordPress||%{tx.domain}|%{tx.mode}|2',phase:2,pass,nolog,t:none,skipAfter:'IGNORE_SFS_XSS_SQLi_WP',rev:1,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule TX:WordPress "@eq 1" \
"id:225040,chain,msg:'COMODO WAF: XSS vulnerability in WordPress 3.7 to 4.4 (CVE-2016-1564)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,rev:2,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule ARGS:theme "@contains <" \
"chain,t:none,t:urlDecodeUni"
SecRule REQUEST_BASENAME "@streq customize.php" \
"t:none,t:urlDecodeUni,t:lowercase"
SecRule TX:WordPress "@eq 1" \
"id:225120,chain,msg:'COMODO WAF: XSS vulnerability in WordPress before 4.6.1 (CVE-2016-7168)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,rev:2,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule REQUEST_BASENAME "@streq media-new.php" \
"chain,t:none,t:urlDecodeUni"
SecRule FILES "@rx (?:\<(.+)\>)" \
"chain,capture,t:none,t:urlDecodeUni"
SecRule TX:1 "@contains =" \
"t:none"
SecRule TX:WordPress "@eq 1" \
"id:225100,chain,msg:'COMODO WAF: XSS vulnerability in the network settings page in WordPress 4.4.4 (CVE-2016-6634)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,rev:2,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule REQUEST_FILENAME "@contains wp-admin/network/settings.php" \
"chain,t:none,t:normalizePath"
SecRule ARGS_POST:first_comment_author "@rx \x22" \
"t:none,t:urlDecodeUni,t:htmlEntityDecode"
SecRule TX:WordPress "@eq 1" \
"id:225140,chain,msg:'COMODO WAF: XSS vulnerability in the in WordPress before 4.5.3 (CVE-2016-5834)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,rev:3,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule ARGS_POST:action "@streq upload-attachment" \
"chain,t:none,t:urlDecodeUni,t:lowercase"
SecRule FILES "@contains <" \
"chain,t:none,t:urlDecodeUni"
SecRule REQUEST_BASENAME "@streq async-upload.php" \
"t:none,t:urlDecodeUni,t:lowercase"
SecRule TX:WordPress "@eq 1" \
"id:225141,chain,msg:'COMODO WAF: XSS vulnerability in the in WordPress before 4.5.3 (CVE-2016-5834)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,rev:3,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule ARGS_POST:html-upload "@streq upload" \
"chain,t:none,t:lowercase"
SecRule FILES "@contains <" \
"chain,t:none,t:urlDecodeUni"
SecRule REQUEST_FILENAME "@streq media-new.php" \
"t:none,t:urlDecodeUni,t:lowercase"
SecRule TX:Wordpress "@eq 1" \
"id:225150,chain,msg:'COMODO WAF: XSS vulnerability in WordPress before 4.3.1 (CVE-2015-7989)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,rev:2,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule ARGS_POST:email "@contains '" \
"chain,t:none,t:urlDecodeUni"
SecRule REQUEST_FILENAME "@rx \/wp-admin\/(?:user\-(?:new|edit)|profile)\.php$" \
"t:none,t:urlDecodeUni,t:normalizePath,t:lowercase"
SecMarker IGNORE_SFS_XSS_SQLi_WP
SecRule TX:WordPress "@eq 1" \
"id:225110,chain,msg:'COMODO WAF: Authenticated Denial of Service by Path Traversal in WordPress 4.5.3 (CVE-2016-6896)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,rev:2,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule ARGS:action "@streq update-plugin" \
"chain,t:none,t:urlDecodeUni"
SecRule REQUEST_BASENAME "@streq admin-ajax.php" \
"chain,t:none,t:urlDecodeUni"
SecRule ARGS_POST:plugin "@rx (?:^[\\\/]|:|\.\.)[\\\/]" \
"t:none,t:urlDecodeUni"
SecRule TX:WordPress "@eq 1" \
"id:225210,chain,msg:'COMODO WAF: Unrestricted file upload vulnerability in WordPress 4.9.7 (CVE-2018-14028)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,rev:2,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule REQUEST_BASENAME "@streq update.php" \
"chain,t:none,t:urlDecodeUni,t:lowercase"
SecRule ARGS_GET:action "@rx ^upload-(?:plugin|theme)$" \
"chain,t:none,t:urlDecodeUni,t:lowercase"
SecRule FILES "!@rx \.zip$" \
"t:none,t:urlDecodeUni,t:lowercase"
SecRule TX:WordPress "@eq 1" \
"id:225240,chain,msg:'COMODO WAF: LFI vulnerability in WordPress through 5.0.3 (CVE-2019-8943)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,rev:1,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule &ARGS_POST:attachment_url "@ge 1" \
"chain,t:none"
SecRule ARGS_POST:meta_input[_wp_attached_file] "@contains ../" \
"t:none,t:urlDecodeUni"
SecMarker WP_Skip_URF_225040
SecRule REQUEST_FILENAME "@contains /wp-content/plugins/sexy-contact-form/includes/fileupload/" \
"id:240020,chain,msg:'COMODO WAF: Protecting WordPress Creative Contact Form Files folder||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,t:none,t:urlDecodeUni,t:lowercase,t:normalizePath,rev:5,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule FILES "@rx \.(?:php|js|pl)(?:\.|$)" \
"t:none,t:lowercase,t:urlDecodeUni"
SecRule REQUEST_FILENAME "@contains /wp-content/plugins/sexy-contact-form/includes/fileupload/files/" \
"id:240022,chain,msg:'COMODO WAF: Protecting WordPress Creative Contact Form Files folder||%{tx.domain}|%{tx.mode}|2',phase:2,deny,deny,status:403,log,t:none,t:urlDecodeUni,t:lowercase,t:normalizePath,rev:5,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule REQUEST_BASENAME "@rx \.(?:php|js|pl)(?:\.|$)" \
"t:none,t:urlDecodeUni,t:lowercase"
SecRule ARGS:comment "@ge 65536" \
"id:225010,chain,msg:'COMODO WAF: XSS vulnerability in WordPress before 4.2.1 (CVE-2015-3440,CVE-2015-8834)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:length,rev:4,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule REQUEST_FILENAME "@endsWith wp-comments-post.php" \
"t:none,t:lowercase"
SecRule ARGS:content "@ge 65536" \
"id:225011,chain,msg:'COMODO WAF: XSS vulnerability in WordPress before 4.2.1 (CVE-2015-3440)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:length,rev:4,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule REQUEST_FILENAME "@endsWith comment.php" \
"chain,t:none,t:lowercase"
SecRule REQUEST_COOKIES_NAMES "@contains wordpress_" \
"t:none"
SecRule ARGS:comment "@contains %u" \
"id:225030,chain,msg:'COMODO WAF: XSS vulnerability in WordPress before 4.1.2 (CVE-2015-3438)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,t:lowercase,rev:5,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule REQUEST_FILENAME "@endsWith wp-comments-post.php" \
"chain,t:none,t:lowercase"
SecRule ARGS:comment "@rx (\%u[a-f0-9]{5,8})" \
"chain,capture,t:none,t:utf8toUnicode"
SecRule TX:1 "@beginsWith 0" \
"chain,t:none,t:urlDecodeUni,t:hexEncode"
SecRule TX:1 "@eq 4" \
"t:none,t:urlDecodeUni,t:hexEncode,t:length"
SecRule TX:WordPress "@eq 1" \
"id:225031,chain,msg:'COMODO WAF: XSS vulnerability in WordPress before 4.1.2 (CVE-2015-3438)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,rev:5,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule &ARGS:comment_ID "@ge 1" \
"chain,t:none"
SecRule ARGS:comment "@contains %u" \
"chain,t:none,t:lowercase"
SecRule ARGS:content "@rx (\%u[a-f0-9]{5,8})" \
"chain,capture,t:none,t:utf8toUnicode"
SecRule REQUEST_FILENAME "@rx (?:admin\-ajax|comment).php$" \
"chain,t:none,t:lowercase"
SecRule TX:1 "@eq 4" \
"chain,t:none,t:urlDecodeUni,t:hexEncode,t:length"
SecRule TX:1 "@beginsWith 0" \
"t:none,t:urlDecodeUni,t:hexEncode"
SecRule REQUEST_FILENAME "@contains /wp-includes/js/" \
"id:225080,chain,msg:'COMODO WAF: XSS vulnerability in Plupload before 2.1.9 or MediaElement.js before 2.21.0, as used in WordPress before 4.5.2 (CVE-2016-4566 & CVE-2016-4567)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,t:urlDecodeUni,t:normalizePath,t:lowercase,rev:1,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule REQUEST_BASENAME "@within flashmediaelement.swf plupload.flash.swf" \
"chain,t:none,t:lowercase"
SecRule ARGS_GET "!@rx ^[\d\.ab]+$" \
"t:none"
SecRule REQUEST_FILENAME "@contains wp/v2/posts" \
"id:225160,chain,msg:'COMODO WAF: Content injection vulnerability in WordPress 4.7.x before 4.7.2 (CVE-2017-1001000)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,t:urlDecodeUni,t:normalizePath,t:lowercase,rev:2,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule ARGS:id "@rx \D" \
"t:none"
SecRule REQUEST_URI "@contains /wp-json/wp/v2/users" \
"id:225170,chain,msg:'COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,t:urlDecodeUni,t:normalizePath,t:lowercase,rev:3,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule &REQUEST_COOKIES_NAMES:/^wordpress_logged_in_[0-9a-fA-F]{32}$/ "@eq 0" \
"chain,t:none"
SecRule &REQUEST_COOKIES_NAMES:/^wordpress_[0-9a-fA-F]{32}$/ "@eq 0" \
"t:none"
SecRule &IP:wp_pressthis_dos "@eq 0" \
"id:225180,chain,msg:'COMODO WAF: Tracking possible DoS attempt in WordPress before 4.7.3 (CVE-2017-6819)||%{tx.domain}|%{tx.mode}|2',phase:2,pass,nolog,t:none,rev:3,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule ARGS:url-scan-submit|ARGS:u "!@rx ^$" \
"chain,t:none"
SecRule REQUEST_FILENAME "@endsWith wp-admin/press-this.php" \
"setvar:'ip.wp_pressthis=+1',expirevar:'ip.wp_pressthis=10',t:none,t:urlDecodeUni,t:normalisePath,t:lowercase"
SecRule &IP:wp_pressthis_dos "@eq 0" \
"id:225181,chain,msg:'COMODO WAF: Tracking possible DoS attempt in WordPress before 4.7.3 (CVE-2017-6819)||%{tx.domain}|%{tx.mode}|2',phase:2,pass,nolog,t:none,rev:3,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule IP:wp_pressthis "@ge 5" \
"setvar:'ip.wp_pressthis_dos=1',expirevar:'ip.wp_pressthis_dos=300',t:none"
SecRule IP:wp_pressthis_dos "@eq 1" \
"id:225182,chain,msg:'COMODO WAF: Possible DoS attempt in WordPress before 4.7.3 (CVE-2017-6819)||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,rev:3,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule &ARGS:url-scan-submit "@ge 1" \
"chain,t:none"
SecRule REQUEST_FILENAME "@endsWith wp-admin/press-this.php" \
"t:none,t:urlDecodeUni,t:normalisePath,t:lowercase"
SecRule ARGS_GET:fn "@contains .." \
"id:225190,chain,msg:'COMODO WAF: Unauthenticated Directory traversal vulnerability in Javo Spot Premium Theme for WordPress||%{tx.domain}|%{tx.mode}|2',phase:2,deny,status:403,log,t:none,t:urlDecodeUni,rev:1,severity:2,tag:'CWAF',tag:'WordPress'"
SecRule ARGS_GET:action "@streq jvfrm_spot_get_json" \
"chain,t:none,t:urlDecodeUni,t:lowercase"
SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \
"t:none,t:urlDecodeUni,t:normalisePath,t:lowercase"