[draft] Add vpatch-CVE-2025-30220 rule and test

.appsec-tests/vpatch-CVE-2025-30220/CVE-2025-30220.yaml

@@ -0,0 +1,28 @@
+## autogenerated on 2025-07-02 14:55:05
+id: CVE-2025-30220
+info:
+  name: CVE-2025-30220
+  author: crowdsec
+  severity: info
+  description: CVE-2025-30220 testing
+  tags: appsec-testing
+http:
+  - raw:
+      - |
+        POST /geoserver/wfs HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/xml
+
+        <wfs:GetFeature service="WFS" version="1.0.0"
+        xmlns:wfs="http://www.opengis.net/wfs"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xmlns:topp="http://www.openplans.org/topp"
+        xsi:schemaLocation="http://a http://{{interactsh-url}}/xxe.xsd"
+        outputFormat="KML">
+        <wfs:Query typeName="topp:states"/>
+        </wfs:GetFeature>
+    cookie-reuse: true
+    matchers:
+    - type: status
+      status:
+       - 403

.appsec-tests/vpatch-CVE-2025-30220/config.yaml

@@ -0,0 +1,5 @@
+## autogenerated on 2025-07-02 14:55:05
+appsec-rules:
+  - ./appsec-rules/crowdsecurity/base-config.yaml
+  - ./appsec-rules/crowdsecurity/vpatch-CVE-2025-30220.yaml
+nuclei_template: CVE-2025-30220.yaml

appsec-rules/crowdsecurity/vpatch-CVE-2025-30220.yaml

@@ -0,0 +1,31 @@
+## autogenerated on 2025-07-02 14:55:05
+name: crowdsecurity/vpatch-CVE-2025-30220
+description: 'Detects XXE processing vulnerability in GeoServer WFS endpoint (CVE-2025-30220)'
+rules:
+  - and:
+      - zones:
+          - URI
+        transform:
+          - lowercase
+        match:
+          type: contains
+          value: /geoserver/wfs
+      - zones:
+          - RAW_BODY
+        transform:
+          - lowercase
+        match:
+          type: contains
+          value: 'xsi:schemalocation='
+
+labels:
+  type: exploit
+  service: http
+  confidence: 3
+  spoofable: 0
+  behavior: 'http:exploit'
+  label: 'GeoServer - XXE'
+  classification:
+    - cve.CVE-2025-30220
+    - attack.T1190
+    - cwe.CWE-611

collections/crowdsecurity/appsec-virtual-patching.yaml

@@ -103,6 +103,7 @@ appsec-rules:
 - crowdsecurity/vpatch-CVE-2025-29306
 - crowdsecurity/vpatch-CVE-2025-49113
 - crowdsecurity/appsec-generic-test
+- crowdsecurity/vpatch-CVE-2025-30220
 author: crowdsecurity
 contexts:
 - crowdsecurity/appsec_base

taxonomy/scenarios.json

@@ -2366,6 +2366,28 @@
       "CWE-285"
     ]
   },
+  "crowdsecurity/vpatch-CVE-2025-30220": {
+    "name": "crowdsecurity/vpatch-CVE-2025-30220",
+    "description": "Detects XXE processing vulnerability in GeoServer WFS endpoint (CVE-2025-30220)",
+    "label": "GeoServer - XXE",
+    "behaviors": [
+      "http:exploit"
+    ],
+    "mitre_attacks": [
+      "TA0001:T1190"
+    ],
+    "confidence": 3,
+    "spoofable": 0,
+    "cti": true,
+    "service": "http",
+    "created_at": "2025-07-02 16:55:09",
+    "cves": [
+      "CVE-2025-30220"
+    ],
+    "cwes": [
+      "CWE-611"
+    ]
+  },
   "crowdsecurity/vpatch-CVE-2025-31161": {
     "name": "crowdsecurity/vpatch-CVE-2025-31161",
     "description": "Detects authentication bypass in CrushFTP via crafted Authorization header and specific endpoint access.",