Add CVE-2024-8190

.appsec-tests/vpatch-CVE-2024-8190/config.yaml

@@ -0,0 +1,5 @@
+
+appsec-rules:
+- ./appsec-rules/crowdsecurity/base-config.yaml
+- ./appsec-rules/crowdsecurity/vpatch-CVE-2024-8190.yaml
+nuclei_template: test-CVE-2024-8190.yaml

.appsec-tests/vpatch-CVE-2024-8190/test-CVE-2024-8190.yaml

@@ -0,0 +1,26 @@
+
+id: test-CVE-2024-8190
+info:
+  name: test-CVE-2024-8190
+  author: crowdsec
+  severity: info
+  description: test-CVE-2024-8190 testing
+  tags: appsec-testing
+http:
+  - raw:
+      - |
+        POST /gsb/datetime.php HTTP/1.1
+        Host: {{Hostname}}
+        Content-Length: 147
+        Content-Type: application/x-www-form-urlencoded
+        Authorization: Basic dG90bzp0YXRh
+
+        dateTimeFormSubmitted=1&TIMEZONE=%3B+%60ls+-la%60+%3B&CYEAR=2024&CMONTH=9&CDAY=13&CHOUR=12&CMIN=34&LDCSA_CSRF=1a2b3c4d5e6f7g8h9i0j&SUBMIT_TIME=Save
+      
+    cookie-reuse: true
+    matchers:
+      - type: dsl
+        condition: and
+        dsl:
+          - "status_code_1 == 403"
+

appsec-rules/crowdsecurity/vpatch-CVE-2024-8190.yaml

@@ -0,0 +1,38 @@
+
+name: crowdsecurity/vpatch-CVE-2024-8190
+description: "Ivanti Cloud Services Appliance - RCE (CVE-2024-8190)"
+rules:
+  - and:
+    - zones:
+      - METHOD
+      match:
+        type: equals
+        value: POST
+    - zones:
+      - URI
+      transform:
+      - lowercase
+      match:
+        type: endsWith
+        value: /gsb/datetime.php
+    - zones:
+      - BODY_ARGS
+      variables:
+       - TIMEZONE
+      transform:
+      - lowercase
+      match:
+        type: contains
+        value: ";"
+labels:
+  type: exploit
+  service: http
+  confidence: 3
+  spoofable: 0
+  behavior: "http:exploit"
+  label: "Ivanti Cloud Services Appliance - RCE"
+  classification:
+   - cve.CVE-2024-8190
+   - attack.T1595
+   - attack.T1190
+   - cwe.CWE-78

collections/crowdsecurity/appsec-virtual-patching.yaml

@@ -63,6 +63,7 @@ appsec-rules:
 - crowdsecurity/vpatch-CVE-2024-29973
 - crowdsecurity/vpatch-CVE-2022-41082
 - crowdsecurity/vpatch-CVE-2019-18935
+- crowdsecurity/vpatch-CVE-2024-8190
 author: crowdsecurity
 contexts:
 - crowdsecurity/appsec_base