Add vpatch-CVE-2021-25281 rule and test #1630
Conversation
|
Hello @crowdsec-automation and thank you for your contribution! ❗ It seems that the following scenarios are not part of the 'crowdsecurity/appsec-virtual-patching' collection: 🔴 crowdsecurity/vpatch-CVE-2021-25281 🔴 |
|
Hello @crowdsec-automation and thank you for your contribution! I'm a bot that helps maintainers to validate scenarios and ensure they include all the required information. The following items have errors: crowdsecurity/crs-exclusion-plugin-cpanel:
crowdsecurity/crs-exclusion-plugin-dokuwiki:
crowdsecurity/crs-exclusion-plugin-drupal:
crowdsecurity/crs-exclusion-plugin-nextcloud:
crowdsecurity/crs-exclusion-plugin-phpbb:
crowdsecurity/crs-exclusion-plugin-phpmyadmin:
crowdsecurity/crs-exclusion-plugin-wordpress:
crowdsecurity/crs-exclusion-plugin-xenforo:
Mitre ATT&CKInformation about mitre attack can be found here.
Expected format is (where labels:
classification:
- attack.TXXXXCVEsIf your scenario covers a specific CVE (Common Vulnerabilities and Exposures), please add it. Expected format is (where labels:
classification:
- cve.CVE-XXX-XXXBehaviorsPlease identify the behavior(s) your scenario is targeting. You can find the list of available behaviors here. Expected format is (where labels:
behavior: <behavior>See the labels documentation for more information. |
|
Hello @buixor and thank you for your contribution! ❗ It seems that the following scenarios are not part of the 'crowdsecurity/appsec-virtual-patching' collection: 🔴 crowdsecurity/vpatch-CVE-2023-0600 🔴 |
|
Hello @buixor and thank you for your contribution! I'm a bot that helps maintainers to validate scenarios and ensure they include all the required information. The following items have errors: crowdsecurity/crs-exclusion-plugin-cpanel:
crowdsecurity/crs-exclusion-plugin-dokuwiki:
crowdsecurity/crs-exclusion-plugin-drupal:
crowdsecurity/crs-exclusion-plugin-nextcloud:
crowdsecurity/crs-exclusion-plugin-phpbb:
crowdsecurity/crs-exclusion-plugin-phpmyadmin:
crowdsecurity/crs-exclusion-plugin-wordpress:
crowdsecurity/crs-exclusion-plugin-xenforo:
Mitre ATT&CKInformation about mitre attack can be found here.
Expected format is (where labels:
classification:
- attack.TXXXXCVEsIf your scenario covers a specific CVE (Common Vulnerabilities and Exposures), please add it. Expected format is (where labels:
classification:
- cve.CVE-XXX-XXXBehaviorsPlease identify the behavior(s) your scenario is targeting. You can find the list of available behaviors here. Expected format is (where labels:
behavior: <behavior>See the labels documentation for more information. |
This rule detects exploitation attempts for CVE-2021-25281, an authentication bypass in SaltStack Salt's API. The vulnerability is triggered when an unauthenticated attacker sends a POST request to the
/runendpoint with a JSON body where theclientparameter is set towheel_async. This allows attackers to execute arbitrary wheel modules without proper authentication./runendpoint, using a case-insensitive comparison (lowercasetransform andequalsmatch).clientparameter (using thejson.clientvariable in theBODY_ARGSzone) and checks if its value is exactlywheel_async, again with alowercasetransform for normalization.Validation checklist:
value:fields are lowercase.lowercase.match.valuecontains capital letters.equalsfor exact matches andcontainswhere appropriate (not needed here).andandorin the same rule.