1name: crowdsecurity/vpatch-CVE-2024-27954
2description: "WP Automatic - Path Traversal (CVE-2024-27954)"
3rules:
4  - and:
5    - zones:
6      - METHOD
7      match:
8        type: equals
9        value: GET
10    - zones:
11      - ARGS
12      variables:
13       - wp_automatic
14      transform:
15      - lowercase
16      match:
17        type: equals
18        value: "download"
19    - zones:
20      - ARGS
21      variables:
22       - link
23      transform:
24      - lowercase
25      match:
26        type: startsWith
27        value: "file://"
28labels:
29  type: exploit
30  service: http
31  confidence: 3
32  spoofable: 0
33  behavior: "http:exploit"
34  label: "WP Automatic - Path Traversal"
35  classification:
36   - cve.CVE-2024-27954
37   - attack.T1595
38   - attack.T1190
39   - cwe.CWE-22