1name: crowdsecurity/vpatch-CVE-2024-1212
2description: "Progress Kemp LoadMaster Unauthenticated Command Injection (CVE-2024-1212)"
3rules:
4  - and:
5    - zones:
6      - URI
7      transform:
8      - lowercase
9      match:
10        type: contains
11        value: /access/set
12    - zones:
13      - HEADERS
14      variables:
15      - Authorization
16      match:
17        type: contains
18        value: 'Basic Jzt' #b64encode of ';
19labels:
20  type: exploit
21  service: http
22  confidence: 3
23  spoofable: 0
24  behavior: "http:exploit"
25  label: "Progress LoadMaster - Command Injection"
26  references:
27  - https://rhinosecuritylabs.com/research/cve-2024-1212unauthenticated-command-injection-in-progress-kemp-loadmaster/
28  classification:
29   - cve.CVE-2024-1212
30   - attack.T1595
31   - attack.T1190
32