FM / imh-modsec

/etc/apache2/conf.d/imh-modsec

Name	Size	Mode	Actions
html/	-	0755	rm
01_base_rules.conf	19822	0644	edit dl rm
05_additional_directives.conf	6950	0644	edit dl rm
15_bad_requests.conf	2300	0644	edit dl rm
19_bad_bots.conf	5363	0644	edit dl rm
20_known_hacks.conf	4886	0644	edit dl rm
21_spam_scripts.conf	1599	0644	edit dl rm
31_shellshock.conf	806	0644	edit dl rm
40_wordpress.conf	9511	0644	edit dl rm
40_xmlrpc.conf	2374	0644	edit dl rm
47_premium_web_builder.conf	83	0644	edit dl rm
alibaba_cidrtrack.lua	12769	0644	edit dl rm
alibaba_network.txt	1789	0644	edit dl rm
bot_budget_bots.txt	113	0644	edit dl rm
bot_ratelimit.lua	2921	0644	edit dl rm
imh-renumber.csv	2460	0644	edit dl rm

Edit: /etc/apache2/conf.d/imh-modsec/31_shellshock.conf (806B)

# both.conf # Rules intended to potentially mitigate the BASH "shellshock" bug # T3 Trac #8148 (https://trac.imhtech.net/T3/ticket/8148) SecRule REQUEST_HEADERS "^\(\) {" \ "phase:1,deny,id:13100,t:urlDecode,status:403,log,\ msg:'CVE-2014-6271 - Bash Attack'" SecRule REQUEST_LINE "\(\) {" \ "phase:1,deny,id:13101,status:403,log,\ msg:'CVE-2014-6271 - Bash Attack'" SecRule ARGS_NAMES "^\(\) {" \ "phase:2,deny,id:13102,t:urlDecode,t:urlDecodeUni,status:403,log,\ msg:'CVE-2014-6271 - Bash Attack'" SecRule ARGS "^\(\) {" \ "phase:2,deny,id:13103,t:urlDecode,t:urlDecodeUni,status:403,log,\ msg:'CVE-2014-6271 - Bash Attack'" SecRule FILES_NAMES "^\(\) {" \ "phase:2,deny,id:13104,t:urlDecode,t:urlDecodeUni,status:403,log,\ msg:'CVE-2014-6271 - Bash Attack'"