1
2name: crowdsecurity/vpatch-CVE-2022-26134
3description: "Confluence - RCE (CVE-2022-26134)"
4rules:
5  - and:
6    - zones:
7      - METHOD
8      match:
9        type: equals
10        value: GET
11    - zones:
12      - URI
13      transform:
14      - urldecode
15      - lowercase
16      match:
17        type: startsWith
18        value: '/${'
19    - zones:
20      - URI
21      transform:
22      - urldecode
23      - lowercase
24      match:
25        type: contains
26        value: "@java.lang.runtime"
27    - zones:
28      - URI
29      transform:
30      - urldecode
31      - lowercase
32      match:
33        type: contains
34        value: "@org.apache.commons.io.ioutils"
35labels:
36  type: exploit
37  service: http
38  confidence: 3
39  spoofable: 0
40  behavior: "http:exploit"
41  label: "Confluence - RCE"
42  classification:
43   - cve.CVE-2022-26134
44   - attack.T1595
45   - attack.T1190
46   - cwe.CWE-917
47