InfraFenceInfraFence

Live Security Operations

Get Started

Virtual patches

InfraFence virtual patches - narrow ModSecurity rules that block actively exploited CVEs on Apache until you can update, with an enforcement check and automatic rollback.

Last updated:

When a vulnerability is being exploited and the update cannot be installed right away, a virtual patch blocks the attack in the web server: a narrow ModSecurity rule for that one CVE.

The catalog

The catalog is built into the agent: the dashboard only sends the id of a patch, never a rule of its own.

CVE What it blocks
CVE-2021-41773 Apache HTTP Server 2.4.49 path traversal and file disclosure
CVE-2021-42013 Apache HTTP Server 2.4.50 path traversal with double encoding
CVE-2024-4577 PHP-CGI argument injection through a soft hyphen in the query string
CVE-2021-44228 Apache Log4j JNDI lookup (Log4Shell), including obfuscated forms
CVE-2022-26134 Atlassian Confluence OGNL injection in the request path
CVE-2023-22527 Atlassian Confluence template injection through text-inline.vm
CVE-2017-5638 Apache Struts 2 OGNL injection in the Content-Type header
CVE-2023-23752 Joomla 4 web services API information disclosure

Requirements

The same as for ModSecurity: Apache with ModSecurity, Allow web server configuration changes on, and no hosting panel or configuration-management tool in charge of the web server. Not in monitor mode. Virtual patches are a Pro feature, applied by a person from the AI analysis or by AutoMode.

How a patch is applied

  1. The agent notes which SSH ports and sites answer.
  2. It writes the rule (ids 9920000 to 9929999) in its own ModSecurity file, runs apachectl configtest and reloads Apache gracefully.
  3. It checks that SSH and the sites still answer. If not, it removes the patch.
  4. It checks that ModSecurity really enforces the rule, with a harmless probe request answered only by InfraFence's test rule. A ModSecurity that only logs (DetectionOnly) protects nothing: the patch is then removed and reported as ineffective.

Removing a patch is done the same way, from Activity with Undo.