1name: crowdsecurity/vpatch-CVE-2023-33617
2description: "Atlassian Confluence Privesc (CVE-2023-33617)"
3rules:
4  - and:
5    - zones:
6      - METHOD
7      transform:
8      - lowercase
9      match:
10        type: equals
11        value: post
12    - zones:
13      - URI
14      transform:
15      - lowercase
16      match:
17        type: endsWith
18        value: /boaform/admin/formlogin
19    - zones:
20      - BODY_ARGS
21      variables:
22       - username
23      transform:
24      - lowercase
25      match:
26        type: equals
27        value: "admin"
28    - zones:
29      - BODY_ARGS
30      variables:
31       - psd
32      transform:
33      - lowercase
34      match:
35        type: equals
36        value: "parks"
37  - and:
38    - zones:
39      - METHOD
40      match:
41        type: equals
42        value: POST
43    - zones:
44      - URI
45      transform:
46      - lowercase
47      match:
48        type: endsWith
49        value: /boaform/admin/formping
50    - zones:
51      - BODY_ARGS
52      variables:
53      - target_addr
54      transform:
55      - lowercase
56      match:
57        type: regex
58        value: "[^a-f0-9:.]+"
59labels:
60  type: exploit
61  service: http
62  confidence: 3
63  spoofable: 0
64  behavior: "http:exploit"
65  label: "Atlassian Confluence - Privilege Escalation"
66  classification:
67   - cve.CVE-2023-33617
68   - attack.T1595
69   - attack.T1190
70   - cwe.CWE-78