Skip to content

Add CVE-2025-54782 rule and test#38

Open
crowdsec-automation wants to merge 4 commits intomasterfrom
1756738523-CVE-2025-54782
Open

Add CVE-2025-54782 rule and test#38
crowdsec-automation wants to merge 4 commits intomasterfrom
1756738523-CVE-2025-54782

Conversation

@crowdsec-automation
Copy link

This rule targets the NestJS DevTools Integration RCE vulnerability (CVE-2025-54782). The attack is performed by sending a POST request to the /inspector/graph/interact endpoint with a JSON body containing a code field, which is executed unsafely on the server.

  • The first rule condition matches requests where the URI is exactly /inspector/graph/interact, as this is the only endpoint affected.
  • The second rule condition inspects the raw body of the request (since the content-type is text/plain and the body is raw JSON) and checks for the presence of the "code": key, which is required for exploitation.
  • Both matches use the lowercase transform to ensure case-insensitive detection.
  • The rule avoids matching on the specific payload or code content to minimize false negatives and instead focuses on the presence of the dangerous field at the vulnerable endpoint.
  • The labels section includes the correct CVE, ATT&CK, and CWE references as per the input.

Validation checklist:

  • All value: fields are lowercase.
  • All relevant transforms include lowercase.
  • No match.value contains capital letters.
  • The rule uses contains and equals as appropriate, not regex.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants