SquirrelMail - XSS WAF Rule by crowdsecurity | CrowdSec Hub

SquirrelMail - XSS

WAF rulehttp:exploitcve.CVE-2002-1131MITRE T1059cwe.CWE-80

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/vpatch-CVE-2002-1131

Detects XSS attempts in SquirrelMail 1.2.6/1.2.7 via unsanitized input in addressbook, options, search, and help modules.

Install with a top-level collection

1 collection include it

sudo cscli collections install ZoeyVid/npmplus

Installs 5 parsers and 54 scenarios, via WAF - Virtual Patching.

View NPMplus →

Installation

sudo cscli appsec-rules install crowdsecurity/vpatch-CVE-2002-1131

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

appsec-rules/crowdsecurity/vpatch-CVE-2002-1131.yaml· 91 linesGitHub

1## autogenerated on 2025-04-23 12:56:40
2name: crowdsecurity/vpatch-CVE-2002-1131
3description: 'Detects XSS attempts in SquirrelMail 1.2.6/1.2.7 via unsanitized input in addressbook, options, search, and help modules.'
4rules:1
5  - and:
6      - zones:2
7          - URI
8        transform:3
9          - urldecode
10          - lowercase
11        match:4
12          type: contains
13          value: /src/addressbook.php
14      - zones:2
15          - ARGS_NAMES
16        transform:3
17          - urldecode
18          - lowercase
19        match:4
20          type: contains
21          value: <
22  - and:1
23      - zones:2
24          - URI
25        transform:3
26          - urldecode
27          - lowercase
28        match:4
29          type: contains
30          value: /src/options.php
31      - zones:2
32          - ARGS
33        variables:1
34          - optpage
35        transform:3
36          - urldecode
37          - lowercase
38        match:4
39          type: contains
40          value: <

SquirrelMail - XSS

Installation

Configuration

Installed on

Know where it runs