Skip to content

Add vpatch-CVE-2024-32870 rule and test#29

Open
crowdsec-automation wants to merge 4 commits into
masterfrom
1746629943-vpatch-CVE-2024-32870
Open

Add vpatch-CVE-2024-32870 rule and test#29
crowdsec-automation wants to merge 4 commits into
masterfrom
1746629943-vpatch-CVE-2024-32870

Conversation

@crowdsec-automation
Copy link
Copy Markdown

This rule detects unauthorized access to the iTop Hub Connector's information disclosure endpoint, as described in CVE-2024-32870. The detection logic is as follows:

  • It matches requests to /pages/exec.php (case-insensitive, URL-decoded).
  • It ensures the exec_module argument equals itop-hub-connector.
  • It ensures the exec_page argument equals launch.php.
  • It ensures the target argument equals inform_after_setup.
    This combination of URI and argument values uniquely identifies the vulnerable endpoint and prevents false positives from other uses of /pages/exec.php. All value: fields are lowercase, and all relevant transforms (lowercase, urldecode) are applied. The rule uses equals for exact argument matching and contains for the URI, as per best practices. No regex or unnecessary complexity is used, and the rule is optimized for minimal false positives and negatives. The test nuclei template is adapted to expect a 403 response, as required.

Exploit URL: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-32870.yaml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant