1
2name: crowdsecurity/vpatch-CVE-2024-8963
3description: "Ivanti CSA - Path Traversal (CVE-2024-8963)"
4rules:
5  - and:
6    - zones:
7      - METHOD
8      match:
9        type: equals
10        value: GET
11    - zones:
12      - URI
13      transform:
14      - urldecode
15      - lowercase
16      match:
17        type: contains
18        value: "index.php?.php/"
19labels:
20  type: exploit
21  service: http
22  confidence: 3
23  spoofable: 0
24  behavior: "http:exploit"
25  label: "Ivanti CSA - Path Traversal"
26  classification:
27   - cve.CVE-2024-8963
28   - attack.T1595
29   - attack.T1190
30   - cwe.CWE-22