Skip to content

Instantly share code, notes, and snippets.

@SniperSister

SniperSister/gist:96bbf89a579f763884ceb0b434d73b36

Last active June 10, 2018 17:57
Show Gist options
  • Save SniperSister/96bbf89a579f763884ceb0b434d73b36 to your computer and use it in GitHub Desktop.
Save SniperSister/96bbf89a579f763884ceb0b434d73b36 to your computer and use it in GitHub Desktop.
Download ZIP
SA-CORE-2018-002 ruleset
Raw
gistfile1.txt
# SPECIFIC: Block #submit #validate #process #pre_render #post_render #element_validate #after_build #value_callback parameters
SecRule REQUEST_FILENAME "(index\.php|\/$)" "chain,id:003294,t:lowercase,t:none,t:utf8toUnicode,t:urlDecodeUni,t:urldecode,block"
SecRule REQUEST_METHOD "^(GET|POST|HEAD)$" chain
SecRule ARGS_NAMES|REQUEST_COOKIES_NAMES "^\#(submit|validate|pre_render|post_render|element_validate|after_build|value_callback|process)$|\[(?:\'|\")?#(submit|validate|pre_render|post_render|element_validate|after_build|value_callback|process)"
# GENERIC: Block all parameters starting with #
SecRule REQUEST_FILENAME "(index\.php|\/$)" "chain,id:003309,t:lowercase,t:none,t:utf8toUnicode,t:urlDecodeUni,t:urldecode,block"
SecRule REQUEST_METHOD "^(GET|POST|HEAD)$" chain
SecRule ARGS_NAMES|REQUEST_COOKIES_NAMES "^\#|\[(?:\'|\")?\#.*\]"
@silvaf6
Copy link

silvaf6 commented Apr 23, 2018

sorry, what is this exactly, a firewall rule set?

@decafgeek
Copy link

decafgeek commented Apr 26, 2018 •
edited
Loading

@silvaf6 - it's a ruleset for mod_security

@straav
Copy link

straav commented Apr 26, 2018

So in light of SA-CORE-2018-004 would adding destination to the pattern of chain ID 003294 add coverage?

@ylapin
Copy link

ylapin commented Apr 29, 2018

it's this good for drupalgeddon3 ??

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment