add CVE-2024-27954

crowdsecurity · Nov 13, 2024 · ea5ccf3 · ea5ccf3
1 parent 43782a1
commit ea5ccf3
Show file tree

Hide file tree

Showing 5 changed files with 67 additions and 0 deletions.
diff --git a/.appsec-tests/vpatch-CVE-2024-27954/config.yaml b/.appsec-tests/vpatch-CVE-2024-27954/config.yaml
@@ -0,0 +1,5 @@
+
+appsec-rules:
+- ./appsec-rules/crowdsecurity/base-config.yaml
+- ./appsec-rules/crowdsecurity/vpatch-CVE-2024-27954.yaml
+nuclei_template: test-CVE-2024-27954.yaml
diff --git a/.appsec-tests/vpatch-CVE-2024-27954/test-CVE-2024-27954.yaml b/.appsec-tests/vpatch-CVE-2024-27954/test-CVE-2024-27954.yaml
@@ -0,0 +1,20 @@
+
+id: test-CVE-2024-27954
+info:
+  name: test-CVE-2024-27954
+  author: crowdsec
+  severity: info
+  description: test-CVE-2024-27954 testing
+  tags: appsec-testing
+http:
+  - raw:
+      - |
+        GET /?p=3232&wp_automatic=download&link=file:///etc/passwd HTTP/1.1
+        Host: {{Hostname}}
+    cookie-reuse: true
+    matchers:
+      - type: dsl
+        condition: and
+        dsl:
+          - "status_code_1 == 403"
+
diff --git a/appsec-rules/crowdsecurity/vpatch-CVE-2024-27954.yaml b/appsec-rules/crowdsecurity/vpatch-CVE-2024-27954.yaml
@@ -0,0 +1,40 @@
+
+name: crowdsecurity/vpatch-CVE-2024-27954
+description: "WP Automatic - Path Traversal (CVE-2024-27954)"
+rules:
+  - and:
+    - zones:
+      - METHOD
+      match:
+        type: equals
+        value: GET
+    - zones:
+      - ARGS
+      variables:
+       - wp_automatic
+      transform:
+      - lowercase
+      match:
+        type: equals
+        value: "download"
+    - zones:
+      - ARGS
+      variables:
+       - link
+      transform:
+      - lowercase
+      match:
+        type: startsWith
+        value: "file://"
+labels:
+  type: exploit
+  service: http
+  confidence: 3
+  spoofable: 0
+  behavior: "http:exploit"
+  label: "WP Automatic - Path Traversal"
+  classification:
+   - cve.CVE-2024-27954
+   - attack.T1595
+   - attack.T1190
+   - cwe.CWE-22
diff --git a/collections/crowdsecurity/appsec-virtual-patching.yaml b/collections/crowdsecurity/appsec-virtual-patching.yaml
@@ -68,6 +68,7 @@ appsec-rules:
 - crowdsecurity/vpatch-CVE-2024-38856
 - crowdsecurity/vpatch-CVE-2018-20062
 - crowdsecurity/vpatch-CVE-2021-26086
+- crowdsecurity/vpatch-CVE-2024-27954
 author: crowdsecurity
 contexts:
 - crowdsecurity/appsec_base

diff --git a/collections/crowdsecurity/appsec-wordpress.yaml b/collections/crowdsecurity/appsec-wordpress.yaml
@@ -13,6 +13,7 @@ appsec-rules:
   - crowdsecurity/vpatch-CVE-2024-1061
   - crowdsecurity/vpatch-CVE-2024-1071
   - crowdsecurity/generic-wordpress-uploads-php
+  - crowdsecurity/vpatch-CVE-2024-27954
 appsec-configs:
   - crowdsecurity/virtual-patching
 description: "A virtual patching collection, suitable for WordPress websites"