1name: crowdsecurity/vpatch-CVE-2023-46805
2description: "Ivanti Connect Auth Bypass (CVE-2023-46805)"
3rules:
4  - and:
5    - zones:
6      - URI
7      transform:
8      - lowercase
9      match:
10        type: contains
11        value: /api/v1/totp/user-backup-code/../
12labels:
13  type: exploit
14  service: http
15  confidence: 3
16  spoofable: 0
17  behavior: "http:exploit"
18  references:
19    - "https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis"
20  label: "Ivanti Connect Secure - Authentication Bypass"
21  classification:
22   - cve.CVE-2023-46805
23   - cve.CVE-2024-21887
24   - attack.T1595
25   - attack.T1190
26   - cwe.CWE-287
27   - cwe.CWE-77
28