Virtual patching to the rescue – How SecureSphere WAF is protecting against vulnerabilities

CVE-2015-5227 (Row 1)  is a WordPress Remote Code Execution vulnerability that attackers have tried to exploit but were clearly blocked by Imperva. In most cases customers also use dynamic profiling and deploy a positive security model where any anomalous access gets automatically blocked even before the ADC content update happens. The continuous updates from Imperva ADC ensures immediate protection against such high profile CVEs.
The more interesting one is CVE-2015-7808  vBulletin PHP object injection where we first suspected a false positive given the high number of hits and server groups. We put on our detective hats, got our magnifying glasses out and further analyzed the payloads from these events.
The majority of events used the following payload (extracted from our community defense data)
[O:12:”vB_dB_Result”:2:{s:5:” * db”;O:11:”vB_Database”:1:{s:9:”functions”;a:1:{s:11:”free_result”;s:6:”system”;}}s:12:” * recordset”;s:20:”echo $((0xfee10000))”;}]
It was no accident that the code snippet is a match to this piece of code from pastebin. The complete listing can be found here http://pastebin.com/r3PgT4Yh
 

We can clearly see that right after we identify the signature echo $((0xfee10000)), there is an object injection that follows.
Vulnerabilies always exist in software, what we constantly notice is how quickly the frequency of attacks increases from the time the CVE is published. Imperva ADC team works round the clock to keep abreast of vulnerabilites via both official and adhoc channels and quickly publishes mitigations taking into account the severity of the CVEs. Virtual Patching is fundamentally important to contain zero day attacks by deploying mitigations quickly without needing to update server software. In this never ending game of cat and mouse, Imperva ADC team is providing the edge and helping our customers stay protected.