1name: crowdsecurity/vpatch-CVE-2023-49070
2description: "Apache OFBiz - RCE (CVE-2023-49070)"
3rules:
4  - and:
5    - zones:
6      - URI
7      transform:
8      - lowercase
9      match:
10        type: endsWith
11        value: /webtools/control/xmlrpc;/
12    - zones:
13      - METHOD
14      match:
15        type: equals
16        value: POST
17    - zones:
18      - ARGS_NAMES
19      transform:
20      - lowercase
21      match:
22        type: equals
23        value: "username"
24    - zones:
25      - ARGS_NAMES
26      transform:
27      - lowercase
28      match:
29        type: equals
30        value: "password"
31    - zones:
32      - ARGS_NAMES
33      transform:
34      - lowercase
35      match:
36        type: equals
37        value: "requirepasswordchange"
38labels:
39  type: exploit
40  service: http
41  confidence: 3
42  spoofable: 0
43  behavior: "http:exploit"
44  label: "Apache OFBiz - RCE"
45  classification:
46   - cve.CVE-2023-49070
47   - attack.T1595
48   - attack.T1190
49   - cwe.CWE-94
50
51
52