Makussu/bunkerweb
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix CVE-2021-20205 and examples update

Browse Source
This commit is contained in:
bunkerity
2021-04-26 17:00:23 +02:00
parent 1a7abab570
commit a98dae1fb6
34 changed files with 268 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
examples/wordpress/docker-compose.yml
View File

@@ -13,6 +13,7 @@ services:
- ./letsencrypt:/etc/letsencrypt
- ./server-confs:/server-confs:ro # custom confs at server context for permalinks
- ./modsec-crs-confs:/modsec-crs-confs:ro # custom Core Rule Set confs to add Wordpress exclusions
- ./modsec-confs:/modsec-confs:ro # avoid some FP with CRS
environment:
- SERVER_NAME=www.website.com # replace with your domain
- AUTO_LETS_ENCRYPT=yes

4
examples/wordpress/modsec-confs/wordpress.conf Normal file
View File

@@ -0,0 +1,4 @@
SecRule REQUEST_FILENAME "/wp-admin/admin-ajax.php" "id:1,ctl:ruleRemoveByTag=attack-xss,ctl:ruleRemoveByTag=attack-rce"
SecRule REQUEST_FILENAME "/wp-admin/options.php" "id:2,ctl:ruleRemoveByTag=attack-xss"
SecRule REQUEST_FILENAME "^/wp-json/yoast" "id:3,ctl:ruleRemoveById=930120"
SecRuleRemoveById 953120