1name: crowdsecurity/vpatch-CVE-2024-7593
2description: "Ivanti vTM - Authentication Bypass (CVE-2024-7593)"
3rules:
4  - and:
5    - zones:
6        - METHOD
7      match:
8        type: equals
9        value: POST
10    - zones:
11        - URI
12      transform:
13        - lowercase
14      match:
15        type: endsWith
16        value: /apps/zxtm/wizard.fcgi
17    - zones:
18        - ARGS
19      variables:
20        - section
21      transform:
22        - urldecode
23        - lowercase
24      match:
25        type: equals
26        value: "access management:localusers"
27    - zones:
28        - ARGS
29      variables:
30        - error
31      transform:
32        - lowercase
33      match:
34        type: equals
35        value: 1
36    - zones:
37        - BODY_ARGS
38      variables:
39        - create_user
40      match:
41        type: equals
42        value: Create
43    - zones:
44        - BODY_ARGS
45      variables:
46        - group
47      match:
48        type: equals
49        value: admin
50    - zones:
51        - BODY_ARGS
52      variables:
53        - newusername
54      match:
55        type: regex
56        value: ^.*$
57    - zones:
58        - BODY_ARGS
59      variables:
60        - password1
61      match:
62        type: regex
63        value: ^.*$
64
65labels:
66  type: exploit
67  service: http
68  confidence: 3
69  spoofable: 0
70  behavior: "http:exploit"
71  label: "Ivanti vTM - Authentication Bypass"
72  classification:
73    - cve.CVE-2024-7593
74    - attack.T1190
75    - cwe.CWE-287
76    - cwe.CWE-303