add vpatch for CVE-2024-51378

.appsec-tests/vpatch-CVE-2024-51378/config.yaml

@@ -0,0 +1,4 @@
+appsec-rules:
+    - ./appsec-rules/crowdsecurity/base-config.yaml
+    - ./appsec-rules/crowdsecurity/vpatch-CVE-2024-51378.yaml
+nuclei_template: vpatch-CVE-2024-51378.yaml

.appsec-tests/vpatch-CVE-2024-51378/vpatch-CVE-2024-51378.yaml

@@ -0,0 +1,30 @@
+id: vpatch-CVE-2024-51378
+info:
+  name: vpatch-CVE-2024-51378
+  author: crowdsec
+  severity: info
+  description: vpatch-CVE-2024-51378 testing
+  tags: appsec-testing
+http:
+#this is a dummy request, edit the request(s) to match your needs
+  - raw:
+    - |
+      POST /dns/getresetstatus HTTP/1.1
+      Host: {{Hostname}}
+      Content-Type: application/json
+
+      {"statusfile": "; id > /tmp/id;#"}
+    - |
+      POST /ftp/getresetstatus HTTP/1.1
+      Host: {{Hostname}}
+      Content-Type: application/json
+
+      {"statusfile": "; id > /tmp/id;#"}
+    cookie-reuse: true
+#test will fail because we won't match http status 
+    matchers:
+    - type: dsl
+      condition: and
+      dsl:
+        - 'status_code_1 == 403'
+        - 'status_code_2 == 403'

appsec-rules/crowdsecurity/vpatch-CVE-2024-51378.yaml

@@ -0,0 +1,35 @@
+name: crowdsecurity/vpatch-CVE-2024-51378
+description: "Cyberpanel - RCE (CVE-2024-51378)"
+rules:
+  - and:
+    - zones:
+      - METHOD
+      match:
+        type: equals
+        value: POST
+    - zones:
+      - URI
+      transform:
+      - lowercase
+      match:
+        type: regex
+        value: /(dns|ftp)/getresetstatus
+    - zones:
+      - BODY_ARGS
+      variables:
+       - json.statusfile
+      match:
+        type: regex
+        value: "[^a-zA-Z0-9/]"
+labels:
+  type: exploit
+  service: http
+  confidence: 3
+  spoofable: 0
+  behavior: "http:exploit"
+  label: "Cyberpanel - RCE"
+  classification:
+   - cve.CVE-2024-51378
+   - attack.T1595
+   - attack.T1190
+   - cwe.CWE-78

collections/crowdsecurity/appsec-virtual-patching.yaml

@@ -78,6 +78,7 @@ appsec-rules:
 - crowdsecurity/vpatch-CVE-2024-8963
 - crowdsecurity/vpatch-CVE-2024-38816
 - crowdsecurity/vpatch-CVE-2024-9465
+- crowdsecurity/vpatch-CVE-2024-51378
 author: crowdsecurity
 contexts:
 - crowdsecurity/appsec_base