1
2name: crowdsecurity/vpatch-CVE-2024-28255
3description: "OpenMetadata - Authentication Bypass (CVE-2024-28255)"
4rules:
5  - and:
6    - zones:
7      - METHOD
8      match:
9        type: equals
10        value: GET
11    - zones:
12      - URI
13      transform:
14      - urldecode
15      - lowercase
16      match:
17        type: contains
18        value: /api/v1;v1/users/login/events/subscriptions/validation/condition
19    - zones:
20      - URI_FULL
21      transform:
22      - lowercase
23      match:
24        type: contains
25        value: "java.lang.runtime"
26
27labels:
28  type: exploit
29  service: http
30  confidence: 3
31  spoofable: 0
32  behavior: "http:exploit"
33  label: "OpenMetadata - Authentication Bypass"
34  classification:
35   - cve.CVE-2024-28255
36   - attack.T1595
37   - attack.T1190
38   - cwe.CWE-94