1name: crowdsecurity/vpatch-CVE-2023-2009
2description: "Pretty Url - XSS (CVE-2023-2009)"
3rules:
4  - and:
5    - zones:
6      - METHOD
7      match:
8        type: equals
9        value: POST
10    - zones:
11      - URI
12      transform:
13      - lowercase
14      match:
15        type: contains
16        value: /wp-admin/admin.php
17    - zones:
18      - ARGS
19      variables:
20      - page
21      transform:
22      - lowercase
23      match:
24        type: equals
25        value: prettyurls
26    - zones:
27      - BODY_ARGS
28      variables:
29      - url
30      match:
31        type: libinjectionXSS
32
33labels:
34  type: exploit
35  service: http
36  confidence: 3
37  spoofable: 0
38  behavior: "http:exploit"
39  label: "Pretty Url - XSS"
40  classification:
41   - cve.CVE-2023-2009
42   - attack.T1595
43   - attack.T1190
44   - cwe.CWE-89