Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 33 additions & 0 deletions appsec-rules/crowdsecurity/vpatch-CVE-2025-1338.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
name: crowdsecurity/vpatch-CVE-2025-1338
description: 'Detects OS command injection in NUUO Camera via log parameter in handle_config.php'
rules:
- and:
- zones:
- URI
transform:
- lowercase
- urldecode
match:
type: contains
value: '/handle_config.php'
- zones:
- ARGS
variables:
- log
transform:
- lowercase
- urldecode
match:
type: contains
value: ';'
labels:
type: exploit
service: http
confidence: 3
spoofable: 0
behavior: 'http:exploit'
label: 'NUUO Camera - RCE'
classification:
- cve.CVE-2025-1338
- attack.T1190
- cwe.CWE-78
35 changes: 35 additions & 0 deletions appsec-rules/crowdsecurity/vpatch-CVE-2025-4078.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
name: crowdsecurity/vpatch-CVE-2025-4078
description: 'Detects path traversal in Wangshen SecGate 3600 via file_name parameter in log_export_file'
rules:
Comment thread
AlteredCoder marked this conversation as resolved.
- and:
- zones:
- ARGS
variables:
- g
transform:
- lowercase
- urldecode
match:
type: equals
value: 'log_export_file'
- zones:
- ARGS
variables:
- file_name
transform:
- lowercase
- urldecode
match:
type: contains
value: '..'
labels:
type: exploit
service: http
confidence: 3
spoofable: 0
behavior: 'http:exploit'
label: 'SecGate 3600 - Path Traversal'
classification:
- cve.CVE-2025-4078
- attack.T1190
- cwe.CWE-22
2 changes: 2 additions & 0 deletions collections/crowdsecurity/appsec-virtual-patching.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,9 @@ appsec-rules:
- crowdsecurity/vpatch-CVE-2022-35914
- crowdsecurity/vpatch-CVE-2022-46169
- crowdsecurity/vpatch-CVE-2023-20198
- crowdsecurity/vpatch-CVE-2025-4078
- crowdsecurity/vpatch-CVE-2023-22515
- crowdsecurity/vpatch-CVE-2025-1338
- crowdsecurity/vpatch-CVE-2023-33617
- crowdsecurity/vpatch-CVE-2023-34362
- crowdsecurity/vpatch-CVE-2023-3519
Expand Down
Loading