1name: crowdsecurity/vpatch-CVE-2023-50164
2description: "Apache Struts2 Path Traversal (CVE-2023-50164)"
3rules:
4  - and:
5    - zones:
6      - METHOD
7      match:
8        type: equals
9        value: POST
10    - zones:
11      - BODY_ARGS
12#it might be used both in POST and GET args: https://trganda.github.io/notes/security/vulnerabilities/apache-struts/Apache-Struts-Remote-Code-Execution-Vulnerability-(-S2-066-CVE-2023-50164)
13      - ARGS
14      variables:
15      - /.+filename$/
16      match:
17        type: contains
18        value: "../"
19labels:
20  type: exploit
21  service: http
22  confidence: 3
23  spoofable: 0
24  behavior: "http:exploit"
25  label: "Apache Struts - Path Traversal"
26  classification:
27   - cve.CVE-2023-50164
28   - attack.T1595
29   - attack.T1190
30   - cwe.CWE-552
31
32
33