Skip to content

Commit 8b4c7f1

Browse files
buixorclaude
buixor
and
claude
authored
Add WAF virtual patches for CVE-2020-37123, CVE-2022-3236, CVE-2025-10353 and improve CVE-2025-2611 (#1720)
* Add WAF virtual patches for CVE-2020-37123, CVE-2022-3236, CVE-2025-10353 and improve CVE-2025-2611 New rules: - vpatch-CVE-2020-37123: Pinger 1.0 RCE via unsanitized ping parameter - vpatch-CVE-2022-3236: Sophos Firewall code injection in User Portal/Webadmin - vpatch-CVE-2025-10353: Melis Platform unrestricted file upload in CMS Slider Improved rule: - vpatch-CVE-2025-2611: ICTBroadcast cookie RCE — switched from COOKIES to HEADERS zone, added urldecode transform, broadened regex to catch $() syntax All rules validated, linted, and tested via Docker harness (403 blocks confirmed). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Update vpatch-CVE-2025-10353.yaml * Update vpatch-CVE-2025-2611.yaml * Refactor vpatch-CVE-2025-2611.yaml rules Removed unnecessary transformations and updated regex values for better matching. * Add additional metadata to CVE-2025-2611 patch * Update cookie name in CVE-2025-2611.yaml * Update CVE-2025-2611.yaml --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 945db2e commit 8b4c7f1

File tree

13 files changed

+205
-2
lines changed

13 files changed

+205
-2
lines changed

‎.appsec-tests/vpatch-CVE-2020-37123/CVE-2020-37123.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
id: CVE-2020-37123
2+
info:
3+
name: CVE-2020-37123
4+
author: crowdsec
5+
severity: info
6+
description: CVE-2020-37123 testing
7+
tags: appsec-testing
8+
http:
9+
- raw:
10+
- |
11+
POST /ping.php HTTP/1.1
12+
Host: {{Hostname}}
13+
Content-Type: application/x-www-form-urlencoded
14+
15+
ping=127.0.0.1;echo+test
16+
cookie-reuse: true
17+
matchers:
18+
- type: status
19+
status:
20+
- 403

‎.appsec-tests/vpatch-CVE-2020-37123/config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
appsec-rules:
2+
- ./appsec-rules/crowdsecurity/base-config.yaml
3+
- ./appsec-rules/crowdsecurity/vpatch-CVE-2020-37123.yaml
4+
nuclei_template: CVE-2020-37123.yaml

‎.appsec-tests/vpatch-CVE-2022-3236/CVE-2022-3236.yaml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
id: CVE-2022-3236
2+
info:
3+
name: CVE-2022-3236
4+
author: crowdsec
5+
severity: info
6+
description: CVE-2022-3236 testing
7+
tags: appsec-testing
8+
http:
9+
- raw:
10+
- |
11+
POST /userportal/Controller HTTP/1.1
12+
Host: {{Hostname}}
13+
Content-Type: application/x-www-form-urlencoded
14+
X-Requested-With: XMLHttpRequest
15+
16+
mode=451&json=%7b%22username%22%3a%22admin%22%2c%22password%22%3a%22x%22%2c%22languageid%22%3a%221%22%2c%22browser%22%3a%22Firefox_91%22%2c%22_discriminator%22%3a%7b%22curvalue%22%3a%22%3b%60nc%20example.com%2080%60%22%7d%2c%22value%22%3a%22curvalue%22%7d&__RequestType=ajax&t=1710331582506
17+
cookie-reuse: true
18+
matchers:
19+
- type: status
20+
status:
21+
- 403

‎.appsec-tests/vpatch-CVE-2022-3236/config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
appsec-rules:
2+
- ./appsec-rules/crowdsecurity/base-config.yaml
3+
- ./appsec-rules/crowdsecurity/vpatch-CVE-2022-3236.yaml
4+
nuclei_template: CVE-2022-3236.yaml

‎.appsec-tests/vpatch-CVE-2025-10353/CVE-2025-10353.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
id: CVE-2025-10353
2+
info:
3+
name: CVE-2025-10353
4+
author: crowdsec
5+
severity: info
6+
description: CVE-2025-10353 testing
7+
tags: appsec-testing
8+
http:
9+
- raw:
10+
- |
11+
POST /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm HTTP/1.1
12+
Host: {{Hostname}}
13+
Content-Type: multipart/form-data; boundary=----crowdsectest
14+
15+
------crowdsectest
16+
Content-Disposition: form-data; name="mcsdetail_mcslider_id"
17+
18+
0
19+
------crowdsectest
20+
Content-Disposition: form-data; name="mcsdetail_img"; filename="test.php"
21+
Content-Type: text/plain
22+
23+
test
24+
------crowdsectest--
25+
cookie-reuse: true
26+
matchers:
27+
- type: status
28+
status:
29+
- 403

‎.appsec-tests/vpatch-CVE-2025-10353/config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
appsec-rules:
2+
- ./appsec-rules/crowdsecurity/base-config.yaml
3+
- ./appsec-rules/crowdsecurity/vpatch-CVE-2025-10353.yaml
4+
nuclei_template: CVE-2025-10353.yaml

‎.appsec-tests/vpatch-CVE-2025-2611/CVE-2025-2611.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
id: CVE-2025-2611
2+
info:
3+
name: CVE-2025-2611
4+
author: crowdsec
5+
severity: info
6+
description: CVE-2025-2611 testing
7+
tags: appsec-testing
8+
http:
9+
- raw:
10+
- |
11+
GET /login.php HTTP/1.1
12+
Host: {{Hostname}}
13+
Cookie: BROADCAST=`echo${IFS}dGVzdA==|base64${IFS}-d|sh`
14+
cookie-reuse: true
15+
matchers:
16+
- type: status
17+
status:
18+
- 403

‎.appsec-tests/vpatch-CVE-2025-2611/config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
appsec-rules:
2+
- ./appsec-rules/crowdsecurity/base-config.yaml
3+
- ./appsec-rules/crowdsecurity/vpatch-CVE-2025-2611.yaml
4+
nuclei_template: CVE-2025-2611.yaml

‎appsec-rules/crowdsecurity/vpatch-CVE-2020-37123.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: crowdsecurity/vpatch-CVE-2020-37123
2+
description: 'Detects remote code execution via unsanitized ping parameter in Pinger 1.0'
3+
rules:
4+
- and:
5+
- zones:
6+
- URI
7+
transform:
8+
- lowercase
9+
- urldecode
10+
match:
11+
type: contains
12+
value: '/ping.php'
13+
- zones:
14+
- BODY_ARGS
15+
variables:
16+
- ping
17+
transform:
18+
- lowercase
19+
- urldecode
20+
match:
21+
type: regex
22+
value: '[;|&`$]'
23+
labels:
24+
type: exploit
25+
service: http
26+
confidence: 3
27+
spoofable: 0
28+
behavior: 'http:exploit'
29+
label: 'Pinger - RCE'
30+
classification:
31+
- cve.CVE-2020-37123
32+
- attack.T1190
33+
- cwe.CWE-78

‎appsec-rules/crowdsecurity/vpatch-CVE-2022-3236.yaml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: crowdsecurity/vpatch-CVE-2022-3236
2+
description: 'Detects code injection in Sophos Firewall User Portal and Webadmin via JSON parameter'
3+
rules:
4+
- and:
5+
- zones:
6+
- URI
7+
transform:
8+
- lowercase
9+
- urldecode
10+
match:
11+
type: regex
12+
value: '/(userportal|webconsole)/controller'
13+
- zones:
14+
- BODY_ARGS
15+
variables:
16+
- json
17+
transform:
18+
- lowercase
19+
- urldecode
20+
match:
21+
type: regex
22+
value: '`|\$\('
23+
labels:
24+
type: exploit
25+
service: http
26+
confidence: 3
27+
spoofable: 0
28+
behavior: 'http:exploit'
29+
label: 'Sophos Firewall - Code Injection'
30+
classification:
31+
- cve.CVE-2022-3236
32+
- attack.T1190
33+
- cwe.CWE-94

0 commit comments

Comments
 (0)