cscli scenarios install crowdsecurity/CVE-2023-22518Trigger exploits of CVE-2023-22518 Atlassian Confluence Server Improper Authorization that leads to Authentication Bypass
References:
1type: trigger2#debug: true3name: crowdsecurity/CVE-2023-225184description: "Detect CVE-2023-22518 exploits"5filter: |6 Upper(evt.Meta.http_path) contains Upper('/json/setup-restore.action') &&7 Upper(evt.Parsed.verb) == 'POST'8blackhole: 1m9groupby: "evt.Meta.source_ip"10labels:11 type: exploit12 remediation: true13 classification:14 - attack.T159515 - attack.T119016 - cve.CVE-2023-2251817 spoofable: 018 confidence: 119 behavior: "http:exploit"20 label: "Atlassian Confluence Server CVE-2023-22518"21 service: confluence22