199 lines
8.8 KiB
JSON
199 lines
8.8 KiB
JSON
{
|
|
"build_datetime": "2026-11-08T17:09:53Z",
|
|
"rulesets": [
|
|
{
|
|
"id": "edgeguard-cve",
|
|
"name": "EdgeGuard CVE Virtual Patches",
|
|
"version": "1",
|
|
"source": "edgeguard-cve",
|
|
"description": "Virtual patches for named vulnerabilities",
|
|
"enabled": true,
|
|
"priority": 1,
|
|
"rules": [
|
|
{
|
|
"id": "CVE-2016-3081-M1",
|
|
"name": "Apache Struts S2-032 - OGNL execution via the method: prefix",
|
|
"pattern": "(?i)method:#_memberAccess=@ognl\\.OgnlContext@DEFAULT_MEMBER_ACCESS",
|
|
"targets": [
|
|
"uri",
|
|
"query",
|
|
"body"
|
|
],
|
|
"action": "log",
|
|
"severity": "high",
|
|
"category": "cve",
|
|
"cve": "CVE-2016-3081",
|
|
"enabled": true,
|
|
"references": [
|
|
"https://cwiki.apache.org/confluence/display/WW/S2-032",
|
|
"https://nvd.nist.gov/vuln/detail/CVE-2016-3081"
|
|
],
|
|
"origin": "hand-written. The imported pattern was the Nuclei probe's entire OGNL expression, ending in \"\u0026cmd=cat /etc/passwd\", so it only matched an attacker who chose that command with those parameters in that order. This is the 60-character prefix every S2-032 payload shares: the method: prefix plus the _memberAccess assignment that unlocks OGNL. No legitimate request carries it, and every variant does."
|
|
},
|
|
{
|
|
"id": "CVE-2017-9841-N1",
|
|
"name": "PHPUnit - Remote Code Execution",
|
|
"pattern": "(?i)/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin\\.php",
|
|
"targets": [
|
|
"uri"
|
|
],
|
|
"action": "block",
|
|
"severity": "critical",
|
|
"category": "cve",
|
|
"cve": "CVE-2017-9841",
|
|
"enabled": true,
|
|
"references": [
|
|
"https://nvd.nist.gov/vuln/detail/CVE-2017-9841",
|
|
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2017/CVE-2017-9841.yaml"
|
|
],
|
|
"origin": "imported from the Nuclei template by tools/nuclei-importer, then promoted to block by hand. Its path is a file that should never be web-reachable, so a request for it is the attack and there is nothing legitimate to refuse. The other rules in this channel carry action \"log\": the engine records those and adds nothing to the anomaly score, so they cannot refuse anything on their own."
|
|
},
|
|
{
|
|
"id": "CVE-2026-104935-N1",
|
|
"name": "Ivanti Connect Secure \u003c= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Header",
|
|
"pattern": "(?i)X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu\\.cgi",
|
|
"targets": [
|
|
"headers"
|
|
],
|
|
"action": "log",
|
|
"severity": "high",
|
|
"category": "cve",
|
|
"cve": "CVE-2026-104935",
|
|
"enabled": true,
|
|
"references": [
|
|
"https://nvd.nist.gov/vuln/detail/CVE-2026-104935",
|
|
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-104935.yaml"
|
|
],
|
|
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
|
},
|
|
{
|
|
"id": "CVE-2026-105134-N1",
|
|
"name": "AhsayCBS \u003c= 10.3.4 - Unauthenticated RCE",
|
|
"pattern": "(?i)\\.\\./\\.\\./webapps/rps\"\\)\\}\\}",
|
|
"targets": [
|
|
"headers"
|
|
],
|
|
"action": "log",
|
|
"severity": "high",
|
|
"category": "cve",
|
|
"cve": "CVE-2026-105134",
|
|
"enabled": true,
|
|
"references": [
|
|
"https://nvd.nist.gov/vuln/detail/CVE-2026-105134",
|
|
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-105134.yaml"
|
|
],
|
|
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
|
},
|
|
{
|
|
"id": "CVE-2026-110447-N1",
|
|
"name": "Collabora Built-in CODE Server \u003c 26.4.303 - OS Command Injection",
|
|
"pattern": "(?i)/\\.\\./apps/richdocumentscode_arm64/proxy\\.php",
|
|
"targets": [
|
|
"uri"
|
|
],
|
|
"action": "log",
|
|
"severity": "high",
|
|
"category": "cve",
|
|
"cve": "CVE-2026-110447",
|
|
"enabled": true,
|
|
"references": [
|
|
"https://nvd.nist.gov/vuln/detail/CVE-2026-110447",
|
|
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-110447.yaml"
|
|
],
|
|
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
|
},
|
|
{
|
|
"id": "CVE-2026-21589-N1",
|
|
"name": "Atlassian Jira/Confluence/Bitbucket - Pre-Auth Arbitrary File Read",
|
|
"pattern": "(?i)/1\\.0/_/download/resources/com\\.atlassian\\.bitbucket\\.server\\.bitbucket-webpack-INTERNAL:avatar/avatar/\\.\\.::\\.\\.::\\.\\.::\\.\\.::\\.\\.::WEB-INF::urlrewrite\\.xml",
|
|
"targets": [
|
|
"uri"
|
|
],
|
|
"action": "log",
|
|
"severity": "high",
|
|
"category": "cve",
|
|
"cve": "CVE-2026-21589",
|
|
"enabled": true,
|
|
"references": [
|
|
"https://nvd.nist.gov/vuln/detail/CVE-2026-21589",
|
|
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-21589.yaml"
|
|
],
|
|
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
|
},
|
|
{
|
|
"id": "CVE-2026-34908-N1",
|
|
"name": "UniFi OS - Authentication Bypass via Path Traversal (..%2f)",
|
|
"pattern": "(?i)/auth/validate-sso/\\.\\./\\.\\./\\.\\./proxy/users/api/v2/ucs/update/latest_package",
|
|
"targets": [
|
|
"uri"
|
|
],
|
|
"action": "log",
|
|
"severity": "high",
|
|
"category": "cve",
|
|
"cve": "CVE-2026-34908",
|
|
"enabled": true,
|
|
"references": [
|
|
"https://nvd.nist.gov/vuln/detail/CVE-2026-34908",
|
|
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-34908.yaml"
|
|
],
|
|
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
|
},
|
|
{
|
|
"id": "CVE-2026-34910-N1",
|
|
"name": "UniFi OS Server - Command Injection",
|
|
"pattern": "(?i)/auth/validate-sso/\\.\\./\\.\\./\\.\\./proxy/users/api/v2/ucs/update/latest_package",
|
|
"targets": [
|
|
"uri"
|
|
],
|
|
"action": "log",
|
|
"severity": "high",
|
|
"category": "cve",
|
|
"cve": "CVE-2026-34910",
|
|
"enabled": true,
|
|
"references": [
|
|
"https://nvd.nist.gov/vuln/detail/CVE-2026-34910",
|
|
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-34910.yaml"
|
|
],
|
|
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
|
},
|
|
{
|
|
"id": "CVE-2026-75650-N1",
|
|
"name": "Adobe Commerce/Magento \u003c= 2.4.9 - StyleSmuggler Unauthenticated RCE via SSTI",
|
|
"pattern": "(?i)text=\\{\\{block class=Magento\\\\Backend\\\\Block\\\\Widget\\\\Grid\\\\ColumnSet rowUrl=\\$this\\.template_styles cache_key=y\\}\\}",
|
|
"targets": [
|
|
"query"
|
|
],
|
|
"action": "log",
|
|
"severity": "high",
|
|
"category": "cve",
|
|
"cve": "CVE-2026-75650",
|
|
"enabled": true,
|
|
"references": [
|
|
"https://nvd.nist.gov/vuln/detail/CVE-2026-75650",
|
|
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-75650.yaml"
|
|
],
|
|
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
|
},
|
|
{
|
|
"id": "CVE-2026-87902-N1",
|
|
"name": "WordPress Core - PHP Template Path Traversal",
|
|
"pattern": "(?i)pagename=templates/\\.\\./\\.\\./\\.\\./\\.\\./wp-includes/theme-compat/footer",
|
|
"targets": [
|
|
"query"
|
|
],
|
|
"action": "log",
|
|
"severity": "high",
|
|
"category": "cve",
|
|
"cve": "CVE-2026-87902",
|
|
"enabled": true,
|
|
"references": [
|
|
"https://nvd.nist.gov/vuln/detail/CVE-2026-87902",
|
|
"https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/http/cves/2026/CVE-2026-87902.yaml"
|
|
],
|
|
"origin": "imported from the Nuclei template by tools/nuclei-importer; recognises the request shape only, not exploitation"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|