Skip to content

Commit d595836

Browse files
eilanderteilandert
committed
More OWASP compliance, added/modified regression tests
1 parent 1dd30c1 commit d595836

File tree

5 files changed

+203
-53
lines changed

5 files changed

+203
-53
lines changed

‎plugins/wordpress-hardening-before.conf

+72-48
Original file line numberDiff line numberDiff line change
@@ -71,11 +71,14 @@ SecRule REQUEST_FILENAME "^/xmlrpc\.php" \
7171
"id:9522102,\
7272
phase:2,\
7373
t:lowercase,t:normalizePath,t:trim,\
74-
block,\
75-
capture,\
76-
severity:'CRITICAL',\
7774
tag:'wordpress',\
7875
tag:'xmlrpc',\
76+
accuracy:'9',\
77+
maturity:'1',\
78+
severity:'NOTICE',\
79+
ver:'WPHARD/1.0.0',\
80+
block,\
81+
capture,\
7982
logdata:'Request Filename %{REQUEST_FILENAME}',\
8083
msg:'Wordpress hardening: xmlrpc.php access attempt',\
8184
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -96,11 +99,15 @@ SecMarker "BEGIN_WPHARD_USER_ENUMERATION"
9699
SecRule REQUEST_URI "@rx (author\=[0-9]+)|(wp/v2/users)" \
97100
"id:9522104,\
98101
phase:2,\
99-
block,\
100102
t:lowercase,t:normalizePath,t:trim,\
101-
severity:'CRITICAL',\
102103
tag:'wordpress',\
103104
tag:'enumeration',\
105+
accuracy:'9',\
106+
maturity:'1',\
107+
severity:'NOTICE',\
108+
ver:'WPHARD/1.0.0',\
109+
block,\
110+
capture,\
104111
logdata:'Request URI %{REQUEST_URI}',\
105112
msg:'Wordpress hardening: user enumeration detected',\
106113
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -122,11 +129,15 @@ SecRule REQUEST_FILENAME "@rx ^/wp-json/.+" \
122129
"id:9522107,\
123130
phase:2,\
124131
t:lowercase,t:normalizePath,\
125-
block,\
126-
severity:'CRITICAL',\
127132
tag:'wordpress',\
128133
tag:'rest-api',\
129134
tag:'wp-json',\
135+
accuracy:'9',\
136+
maturity:'1',\
137+
severity:'NOTICE',\
138+
ver:'WPHARD/1.0.0',\
139+
block,\
140+
capture,\
130141
logdata:'Request FILENAME %{REQUEST_FILENAME}',\
131142
msg:'Wordpress hardening: /wp-json rest api access detected',\
132143
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -148,10 +159,14 @@ SecRule REQUEST_URI "@beginsWith /wp-login.php" \
148159
"id:9522109,\
149160
phase:2,\
150161
t:lowercase,t:normalizePath,t:trim,\
151-
block,\
152-
severity:'CRITICAL',\
153162
tag:'wordpress',\
154163
tag:'admin-login',\
164+
accuracy:'9',\
165+
maturity:'1',\
166+
severity:'WARNING',\
167+
ver:'WPHARD/1.0.0',\
168+
block,\
169+
capture,\
155170
logdata:'detected admin login',\
156171
msg:'Wordpress hardening: admin login attempt detected',\
157172
chain"
@@ -175,59 +190,52 @@ SecRule REQUEST_FILENAME "^/wp-cron\.php" \
175190
"id:9522111,\
176191
phase:2,\
177192
t:lowercase,t:normalizePath,t:trim,\
178-
block,\
179-
capture,\
180-
severity:'CRITICAL',\
181193
tag:'wordpress',\
182194
tag:'wpcron',\
195+
accuracy:'9',\
196+
maturity:'1',\
197+
severity:'NOTICE',\
198+
ver:'WPHARD/1.0.0',\
199+
block,\
200+
capture,\
183201
logdata:'Request Filename %{REQUEST_FILENAME}',\
184202
msg:'Wordpress hardening: /wp-cron.php access attempt',\
185203
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
186204

187205
SecMarker "END_WPHARD_WPCRON"
188206

189-
# No direct access to .php files or directory listings. (PL1)
190-
SecRule REQUEST_FILENAME "@rx ^/wp-(content|includes)/([^/]*/)*[^/.]+(\.php)?$" \
207+
# No direct access to .php files except index.php/wp-admin/xmlrpc/wpcron
208+
# (regression test)
209+
SecRule REQUEST_FILENAME "@rx ^(?!.*(?:\/wp-admin\/|(?:^|\/)(index|xmlrpc|wp-cron|wp-login)\.php$)).*\.php$" \
191210
"id:9522200,\
192211
phase:2,\
193212
t:lowercase,t:normalizePath,t:trim,\
194-
block,\
195-
capture,\
196-
severity:'CRITICAL',\
197213
tag:'wordpress',\
198-
logdata:'Request Filename %{REQUEST_FILENAME}',\
199-
msg:'Wordpress hardening: Direct access to phpfiles or directory listings in wp-content or wp-includes not allowed',\
200-
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
201-
202-
# Check for inclusion attacks on index.php (PL2)
203-
# (no regression test yet)
204-
SecRule REQUEST_FILENAME "@endsWith /index.php" \
205-
"id:9522201,\
206-
phase:2,\
207-
t:lowercase,t:normalizePath,t:trim,\
214+
tag:'direct-access',\
215+
accuracy:'9',\
216+
maturity:'1',\
217+
severity:'NOTICE',\
218+
ver:'WPHARD/1.0.0',\
208219
block,\
209220
capture,\
210-
severity:'CRITICAL',\
211-
tag:'wordpress',\
212-
tag:'inclusion-attack',\
213-
msg:'Inclusion attack detected on index.php',\
214221
logdata:'Request Filename %{REQUEST_FILENAME}',\
215-
chain"
216-
SecRule ARGS_GET "@contains %2F" \
217-
"setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}',\
218-
chain"
219-
SecRule ARGS_POST "@contains %2F" \
220-
"setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
222+
msg:'Wordpress hardening: attempt to access php files other than index.php',\
223+
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
221224

222225
# No direct access to these files (PL1)
223226
# (regression test)
224227
SecRule REQUEST_FILENAME "@pmFromFile wordpress-hardening-files.data" \
225228
"id:9522202,\
226229
phase:2,\
227230
t:lowercase,t:normalizePath,t:trim,\
228-
block,\
229-
severity:'CRITICAL',\
230231
tag:'wordpress',\
232+
tag:'direct-access',\
233+
accuracy:'9',\
234+
maturity:'1',\
235+
severity:'NOTICE',\
236+
ver:'WPHARD/1.0.0',\
237+
block,\
238+
capture,\
231239
logdata:'Request Filename %{REQUEST_FILENAME}',\
232240
msg:'Wordpress hardening: direct file access attempt on files that dont need that',\
233241
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -238,10 +246,14 @@ SecRule REQUEST_FILENAME "@rx .(pl|cgi|py|sh|lua|asp)$" \
238246
"id:9522203,\
239247
phase:2,\
240248
t:lowercase,t:normalizePath,t:trim,\
241-
block,\
242-
severity:'CRITICAL',\
243249
tag:'wordpress',\
244250
tag:'only-allow-php-extension',\
251+
accuracy:'9',\
252+
maturity:'1',\
253+
severity:'NOTICE',\
254+
ver:'WPHARD/1.0.0',\
255+
block,\
256+
capture,\
245257
logdata:'Request Filename %{REQUEST_FILENAME}',\
246258
msg:'Wordpress hardening: trying another interpreter',\
247259
setvar:'tx.inbound_anomaly_score_pl2=+%{tx.critical_anomaly_score}'"
@@ -252,24 +264,32 @@ SecRule REQUEST_FILENAME "@rx ^/wp-content/uploads/.*\.(?:s?html?|js|swf|lua)$"
252264
"id:9522205,\
253265
phase:2,\
254266
t:lowercase,t:normalizePath,t:trim,\
255-
block,\
256-
severity:'CRITICAL',\
257267
tag:'wordpress',\
258268
tag:'uploads',\
269+
accuracy:'9',\
270+
maturity:'1',\
271+
severity:'NOTICE',\
272+
ver:'WPHARD/1.0.0',\
273+
block,\
274+
capture,\
259275
logdata:'Request Filename %{REQUEST_FILENAME}',\
260276
msg:'Wordpress hardening: attempt to access wp-content/uploads nasty stuff',\
261277
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
262278

263279
# Deny access to sensitive files (Pl1)
264280
# (regression test)
265-
SecRule REQUEST_FILENAME "@rx \.(conf|htaccess|htpass|sql|orig|bak|db|ini|md|log|git|github|swp$|DS_STORE$)($|/)?" \
281+
SecRule REQUEST_FILENAME "@rx \.(conf|htaccess|htpass|sql|orig|bak|db|ini|md|log|git|github|swp|DS_STORE)($|/)?" \
266282
"id:9522206,\
267283
phase:2,\
268284
t:lowercase,t:normalizePath,t:trim,\
269-
block,\
270-
severity:'CRITICAL',\
271285
tag:'wordpress',\
272286
tag:'sensitive-files',\
287+
accuracy:'9',\
288+
maturity:'1',\
289+
severity:'NOTICE',\
290+
ver:'WPHARD/1.0.0',\
291+
block,\
292+
capture,\
273293
logdata:'Request Filename %{REQUEST_FILENAME}',\
274294
msg:'Wordpress hardening: denied access to sensitive files',\
275295
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
@@ -280,11 +300,15 @@ SecRule REQUEST_FILENAME "@rx ^/wp-json/?$" \
280300
"id:9522207,\
281301
phase:2,\
282302
t:lowercase,t:normalizePath,t:trim,\
283-
block,\
284-
severity:'CRITICAL',\
285303
tag:'wordpress',\
286304
tag:'sensitive-files',\
287305
tag:'wp-json',\
306+
accuracy:'9',\
307+
maturity:'1',\
308+
severity:'NOTICE',\
309+
ver:'WPHARD/1.0.0',\
310+
block,\
311+
capture,\
288312
logdata:'Request Filename %{REQUEST_FILENAME}',\
289313
msg:'Wordpress hardening: denied access to ^/wp-json$',\
290314
setvar:'tx.inbound_anomaly_score_pl1=+%{tx.critical_anomaly_score}'"

‎tests/regression/wordpress-hardening-plugin/9522102.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ meta:
66
name: 9522102.yaml
77
tests:
88
- test_title: 9522102
9-
desc: Test if xmlrpc.php is blocked
9+
desc: Test if xmlrpc.php is not blocked (default)
1010
stages:
1111
- stage:
1212
input:

‎tests/regression/wordpress-hardening-plugin/9522104.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ meta:
66
name: 9522104.yaml
77
tests:
88
- test_title: 9522104-1
9-
desc: Test if user enumeration is blocked
9+
desc: Test if user enumeration is blocked (default)
1010
stages:
1111
- stage:
1212
input:
@@ -23,7 +23,7 @@ tests:
2323
output:
2424
log_contains: id "9522104"
2525
- test_title: 9522104-2
26-
desc: Test if user enumeration is blocked
26+
desc: Test if user enumeration is blocked, with caps
2727
stages:
2828
- stage:
2929
input:
@@ -91,7 +91,7 @@ tests:
9191
output:
9292
log_contains: id "9522104"
9393
- test_title: 9522104-6
94-
desc: Test if user enumeration is blocked
94+
desc: Test if user enumeration is blocked through alternative route
9595
stages:
9696
- stage:
9797
input:

‎tests/regression/wordpress-hardening-plugin/9522111.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ meta:
66
name: 9522111.yaml
77
tests:
88
- test_title: 95222111
9-
desc: Test if wp-cron.php works
9+
desc: Test if wp-cron.php is not blocked (default)
1010
stages:
1111
- stage:
1212
input:

‎tests/regression/wordpress-hardening-plugin/9522200.yaml

+126
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
---
2+
meta:
3+
author: Thijs Eilander
4+
description: wordpress-hardening-plugin
5+
enabled: true
6+
name: 9522200.yaml
7+
tests:
8+
- test_title: 9522200-1
9+
desc: Test if php in the plugins directory is blocked
10+
stages:
11+
- stage:
12+
input:
13+
dest_addr: 127.0.0.1
14+
headers:
15+
Host: localhost
16+
User-Agent: OWASP CRS
17+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
18+
port: 80
19+
method: GET
20+
uri: /wp-content/plugins/modsecurity/modsecurity.php
21+
data: |
22+
text
23+
output:
24+
log_contains: id "9522200"
25+
- test_title: 9522200-2
26+
desc: Test if /wp-includes/*.php is blocked
27+
stages:
28+
- stage:
29+
input:
30+
dest_addr: 127.0.0.1
31+
headers:
32+
Host: localhost
33+
User-Agent: OWASP CRS
34+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
35+
port: 80
36+
method: GET
37+
uri: /wp-includes/wp-db.php
38+
data: |
39+
text
40+
output:
41+
log_contains: id "9522200"
42+
- test_title: 9522200-3
43+
desc: Test if /index.php is working
44+
stages:
45+
- stage:
46+
input:
47+
dest_addr: 127.0.0.1
48+
headers:
49+
Host: localhost
50+
User-Agent: OWASP CRS
51+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
52+
port: 80
53+
method: GET
54+
uri: /index.php
55+
data: |
56+
text
57+
output:
58+
no_log_contains: id "9522200"
59+
- test_title: 9522200-4
60+
desc: Test if /wp-admin/admin-ajax.php is working
61+
stages:
62+
- stage:
63+
input:
64+
dest_addr: 127.0.0.1
65+
headers:
66+
Host: localhost
67+
User-Agent: OWASP CRS
68+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
69+
port: 80
70+
method: GET
71+
uri: /wp-admin/admin-ajax.php
72+
data: |
73+
text
74+
output:
75+
no_log_contains: id "9522200"
76+
- test_title: 9522200-5
77+
desc: Test if wp-cron is working
78+
stages:
79+
- stage:
80+
input:
81+
dest_addr: 127.0.0.1
82+
headers:
83+
Host: localhost
84+
User-Agent: OWASP CRS
85+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
86+
port: 80
87+
method: GET
88+
uri: /wp-cron.php
89+
data: |
90+
text
91+
output:
92+
no_log_contains: id "9522200"
93+
- test_title: 9522200-6
94+
desc: Test if xmlrpc is working
95+
stages:
96+
- stage:
97+
input:
98+
dest_addr: 127.0.0.1
99+
headers:
100+
Host: localhost
101+
User-Agent: OWASP CRS
102+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
103+
port: 80
104+
method: GET
105+
uri: /xmlrpc.php
106+
data: |
107+
text
108+
output:
109+
no_log_contains: id "9522200"
110+
- test_title: 9522200-7
111+
desc: Test if wp-login.php is working
112+
stages:
113+
- stage:
114+
input:
115+
dest_addr: 127.0.0.1
116+
headers:
117+
Host: localhost
118+
User-Agent: OWASP CRS
119+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
120+
port: 80
121+
method: GET
122+
uri: /wp-login.php
123+
data: |
124+
text
125+
output:
126+
no_log_contains: id "9522200"

0 commit comments

Comments
 (0)