1name: crowdsecurity/vpatch-CVE-2019-12989
2description: "Citrix SQLi (CVE-2019-12989)"
3rules:
4  - and:
5    - zones:
6      - METHOD
7      match:
8        type: equals
9        value: POST
10    - zones:
11      - URI
12      transform:
13      - lowercase
14      match:
15        type: endsWith
16        value: /sdwan/nitro/v1/config/get_package_file
17    - zones:
18      - ARGS
19      variables:
20       - action
21      transform:
22      - lowercase
23      match:
24        type: equals
25        value: "file_download"
26    - zones:
27      - BODY_ARGS
28      variables:
29       - json.get_package_file.site_name
30      match:
31        type: libinjectionSQL
32labels:
33  type: exploit
34  service: http
35  confidence: 3
36  spoofable: 0
37  behavior: "http:exploit"
38  label: "Citrix - SQL Injection"
39  classification:
40   - cve.CVE-2019-12989
41   - attack.T1595
42   - attack.T1190
43   - cwe.CWE-89