1name: crowdsecurity/vpatch-CVE-2025-15503
2description: 'Detects arbitrary file upload in Sangfor OSM via common.jsp endpoint'
3rules:
4  - and:
5      - zones:
6          - URI
7        transform:
8          - urldecode
9          - lowercase
10        match:
11          type: contains
12          value: '/fort/trust/version/common/common.jsp'
13      - zones:
14          - FILENAMES
15        transform:
16          - lowercase
17        match:
18          type: regex
19          value: '\.(jsp|jspx|war|php|asp|aspx|sh)$'
20labels:
21  type: exploit
22  service: http
23  confidence: 3
24  spoofable: 0
25  behavior: 'http:exploit'
26  label: 'Sangfor OSM - Arbitrary File Upload'
27  classification:
28    - cve.CVE-2025-15503
29    - attack.T1190
30    - cwe.CWE-434
31