1name: crowdsecurity/vpatch-CVE-2024-38856
2description: "Apache OFBiz Incorrect Authorization (CVE-2024-38856)"
3rules:
4  - and:
5      - zones:
6          - METHOD
7        match:
8          type: regex
9          value: (GET|POST)
10      - zones:
11          - URI
12        transform:
13          - lowercase
14        match:
15          type: regex
16          value: /webtools/control/(main|view|testservice|showdatetime|forgotpassword)/programexport
17      - zones:
18          - BODY_ARGS
19          - ARGS
20        variables:
21          - groovyProgram
22        transform:
23          - count
24        match:
25          type: gte
26          value: 1
27labels:
28  type: exploit
29  service: http
30  confidence: 3
31  spoofable: 0
32  behavior: "http:exploit"
33  label: "Apache OFBiz - Incorrect Authorization"
34  classification:
35    - cve.CVE-2024-38856
36    - attack.T1595
37    - attack.T1190
38    - cwe.CWE-853
39