block userAgent on server, with mod_security?

upsforum

Well-Known Member
Jul 27, 2005
473
0
166
What is best solution for block specific userAgent on all websites of server? I have any client that use joomla with old versions insicure, for example this vulnerability:

POST /index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20 HTTP/1.1" 200 10 "-" "BOT/0.1 (BOT for JCE)"

what is best solution for block it on all accounts of server?
 

upsforum

Well-Known Member
Jul 27, 2005
473
0
166
can I post this also in Apache Configuration -> Include Editor -> Post VirtualHost Include right?

thank you
 

quizknows

Well-Known Member
Oct 20, 2009
1,008
87
78
cPanel Access Level
DataCenter Provider
These are the rules I use for that attack:
Code:
#Joomla com_jce exploit
SecRule HTTP_User-Agent "BOT for JCE" "deny,status:500,id:5000218,msg:'Joomla com_jce code exec'"

#Joomla com_jce exploit
SecRule REQUEST_URI "/images/stories/.+\.php" "deny,status:500,id:5000219,msg:'Joomla com_jce code exec'"
The first blocks the user agent. That exploit puts PHP files into site.com/images/stories/something.php if it is successful, so the 2nd rule blocks access to those in case they change user agent.

Even with the .htaccess or this first rule, you should still use the 2nd rule. Changing user agents is very simple.
 
Last edited: