AppSec CVE-2021-3129 transforms and tests

.appsec-tests/CVE-2021-3129/CVE-2021-3129.yaml

@@ -21,10 +21,29 @@ http:
         Content-Type: application/json
 
         {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "phar://../storage/logs/laravel.log/test.txt"}}
+      - |
+        POST /_ignition/execute-solution HTTP/1.1
+        Host: {{Hostname}}
+        Accept: application/json
+        Content-Type: application/json
+
+        {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "cGhhcjovLy4uL3N0b3JhZ2UvbG9ncy9sYXJhdmVsLmxvZy90ZXN0LnR4dA"}}
+## True output of https://dl.packetstormsecurity.net/2104-exploits/laravel-ignition-rce.py.txt
+      - |
+        POST /_ignition/execute-solution HTTP/1.1
+        Host: {{Hostname}}
+        Accept: application/json
+        Content-Type: application/json
+
+        {"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "cve20213129", "viewFile": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAc=00G=00h=00w=00O=00i=008=00v=00Z=00m=00l=00s=00d=00G=00V=00y=00L=003=00d=00y=00a=00X=00R=00l=00P=00W=00N=00v=00b=00n=00Z=00l=00c=00n=00Q=00u=00c=00X=00V=00v=00d=00G=00V=00k=00L=00X=00B=00y=00a=00W=005=000=00Y=00W=00J=00s=00Z=00S=001=00k=00Z=00W=00N=00v=00Z=00G=00V=008=00Y=002=009=00u=00d=00m=00V=00y=00d=00C=005=00p=00Y=002=009=00u=00d=00i=005=001=00d=00G=00Y=00t=00M=00T=00Z=00s=00Z=00S=005=001=00d=00G=00Y=00t=00O=00H=00x=00j=00b=002=005=002=00Z=00X=00J=000=00L=00m=00J=00h=00c=002=00U=002=00N=00C=001=00k=00Z=00W=00N=00v=00Z=00G=00U=00v=00c=00m=00V=00z=00b=003=00V=00y=00Y=002=00U=009=00L=00i=004=00v=00c=003=00R=00v=00c=00m=00F=00n=00Z=00S=009=00s=00b=002=00d=00z=00L=002=00x=00h=00c=00m=00F=002=00Z=00W=00w=00u=00b=00G=009=00n=00=00"}}
 
     cookie-reuse: true
 #test will fail because we won't match http status 
     matchers:
-    - type: status
-      status:
-       - 403
+    - type: dsl
+      condition: and
+      dsl:
+        - 'status_code_1 == 403'
+        - 'status_code_2 == 403'
+        - 'status_code_3 == 403'
+        - 'status_code_4 == 403'

appsec-rules/crowdsecurity/vpatch-CVE-2021-3129.yaml

@@ -13,9 +13,11 @@ rules:
       - BODY_ARGS
       variables:
       - json.parameters.viewFile
+      transform:
+      - b64decode
       match:
         type: regex
-        value: "php://filter|phar://"
+        value: "php://filter|phar://|(?:.?)+(?:.?=00)+"
 labels:
   type: exploit
   service: http