golden hour

/opt/bitninja-waf/etc/BitNinja

File/Folder	Size	Actions
104-TYPO3-MAGENTO-EXCLUSION-RULES.conf	471 B
400-BITNINJA-INITIALIZATION.conf	3.04 KB
400030-status.conf	241 B
401-WORDPRESS-BACKDOOR-PROTECTION.conf	2.73 KB
402-DRUPAL-REMOTE-EXECUTION-PROTECTION.conf	1.8 KB
403-MODX-REVOLUTION-REMOETE-EXECUTION-PROTECTION.conf	455 B
404-SCANNER-PROTECTION.conf	1.57 KB
405-MAGENTO-REMOTE-EXECUTION-PROTECTION.conf	3.98 KB
406-WORDPRESS-PLUGIN-VULNERABILITY-PROTECTION.conf	28.08 KB
407-BOTNET-PROTECTION.conf	1.25 KB
408-SYMFONY-PROTECTION-BN.conf	531 B
409-ANTIMALWARE-PROTECTION-BN.conf	19.11 KB
410-OTHER-BN.conf	12.87 KB
419-REQUEST-BLOCKING-EVALUATION-BN.conf	1.57 KB
botnet-post-request.data	80 B
web-shell-uri.data	195 B

Edit: 405-MAGENTO-REMOTE-EXECUTION-PROTECTION.conf

SecRule REQUEST_LINE "@pm /cms_wysiwyg/" "block,auditlog,phase:2,id:405001,chain,\
    severity:CRITICAL,\
    msg:'Magento Shoplift Remote Code Execution',\
    logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}'"
        SecRule &ARGS:forwarded "!@eq 0" "chain"
        SecRule &ARGS:filter "!@eq 0" "chain"
        SecRule &ARGS:___directive "!@eq 0" "setvar:tx.bn_inbound_found=+1"SecRule REQUEST_FILENAME "@endsWith web/magmi_import_run.php" \
    "id:405002,\
    chain,\
    phase:2,\
    rev:'1',\
    severity:critical,\
    t:none,t:lowercase,t:normalizePath,\
    msg:'Multiple XSS vulnerabilities in the Magento Mass Importer (CVE-2015-2068)',\
    logdata:'Multiple XSS vulnerabilities in the Magento Mass Importer (CVE-2015-2068)'"
SecRule REQUEST_URI "@contains <" "t:none,t:urlDecodeUni,t:htmlEntityDecode,setvar:'tx.bn_inbound_found=+1'"

SecRule REQUEST_FILENAME "@endsWith web/ajax_pluginconf.php" \
    "id:405003,\
    chain,\
    phase:2,\
    rev:'1',\
    severity:critical,\
    t:none,t:lowercase,t:normalizePath,\
    msg:'Directory traversal vulnerability in Magento Mass Importer (CVE-2015-2067)',\
    logdata:'Directory traversal vulnerability in Magento Mass Importer (CVE-2015-2067)'"
SecRule &ARGS:plugintype "@ge 1" "chain,t:none"
SecRule &ARGS:pluginclass "@ge 1" "chain,t:none"
SecRule ARGS:file "@rx \.\.|^\/" "t:none,t:urlDecodeUni,t:htmlEntityDecode,setvar:'tx.bn_inbound_found=+1'"

SecRule REQUEST_URI "@contains product_frontend_action/synchronize" \
    "id:405004,\
    chain,\
    phase:2,\
    rev:'1',\
    severity:critical,\
    t:none,t:normalizePath,t:urlDecodeUni,\
    msg:'SQL Injection vulnerability in Magento (PRODSECBUG-2198)',\
    logdata:'SQL Injection vulnerability in Magento (PRODSECBUG-2198)'"
SecRule ARGS:type_id "@streq recently_products" "t:none,t:urlDecodeUni,chain"
SecRule ARGS:ids[0][product_id][from] "@rx \?" "t:none,t:urlDecodeUni,chain"
SecRule ARGS:ids[0][product_id][to] "@rx \)\)\)" "t:none,t:lowercase,setvar:'tx.bn_inbound_found=+1'"

SecRule REQUEST_METHOD "@rx ^POST$" \
    "id:405005,\
    chain,\
    phase:2,\
    rev:'1',\
    severity:critical,\
    t:none,\
    msg:'Magento Webforms Arbitrary File Upload',\
    logdata:'Magento Webforms Arbitrary File Upload'"
SecRule REQUEST_URI "@endsWith /js/webforms/upload/index.php" "t:none,setvar:'tx.bn_inbound_found=+1'"

SecRule REQUEST_METHOD "^POST$" \
    "id:405006,\
    chain,\
    phase:2,\
    rev:'1',\
    severity:critical,\
    t:none,\
    msg:'Magento Webforms Upload Vulnerability',\
    logdata:'Magento Webforms Upload Vulnerability'"
SecRule REQUEST_URI "@contains /js/webforms/upload/" "chain,t:none,t:urlDecodeUni,t:normalizePath"
SecRule FILES "@rx (\.htaccess|.+\.(pht|phtml|php\d?)$)" "t:urlDecodeUni,t:removeWhitespace,setvar:'tx.bn_inbound_found=+1'"

SecRule REQUEST_URI "@contains /wp-content/plugins/core-engine/" \
    "id:405007,\
    chain,\
    phase:2,\
    rev:'1',\
    severity:critical,\
    t:none,t:normalizePath,\
    msg:'SQLi in Adobe Commerce and Magento Open Source before 2.4.3-p1',\
    logdata:'SQLi in Adobe Commerce and Magento Open Source before 2.4.3-p1'"
SecRule REQUEST_URI "@rx '|\x22|\(" "t:none,setvar:'tx.bn_inbound_found=+1'"

SecRule REQUEST_URI "@pm /checkout/cart/add/uenc/ /review/product/post/id/ /catalogsearch/result/ /gifts/devotional/ /mageworx_searchsuiteautocomplete/ajax/index/ /catalogsearch/searchTermsLog/save/ /search/ajax/suggest/" \
    "id:405008,\
    chain,\
    phase:2,\
    rev:'1',\
    severity:critical,\
    t:none,t:normalizePath,\
    msg:'Inproper input validation in Adobe Commerce and Magento Open Source before 2.4.3',\
    logdata:'Inproper input validation in Adobe Commerce and Magento Open Source before 2.4.3'"
SecRule ARGS "@rx ;|[\x22\d']=[\x22\d']|>|\.\.\/|waitfor delay|\/\*|\(select|(?:benchmark|sleep|convert|cha?r)\(" "t:none,t:htmlEntityDecode,t:urlDecode,t:lowercase,t:compressWhitespace,setvar:'tx.bn_inbound_found=+1'"