Add vpatch-CVE-2024-28752 rule and test

[crowdsec-automation]

This rule detects exploitation attempts for CVE-2024-28752, an SSRF and local file read vulnerability in Apache CXF's Aegis DataBinding via the XOP Include mechanism in multipart SOAP requests.

• The first rule block matches requests to the /test endpoint, which is the target path in the provided nuclei template.
• The second rule block inspects the raw HTTP body for the presence of the XOP Include element with an href attribute pointing to a local file (file://). The match is made case-insensitive by applying the lowercase transform.
• The use of RAW_BODY is appropriate because the payload is a multipart SOAP envelope, not a standard form or JSON argument.
• The detection is focused on the XOP Include pattern with a local file reference, which is the core of the exploit.
• The labels section includes the correct CVE, ATT&CK, and CWE references, and the label follows the required format.

Validation checklist:

• All value: fields are lowercase.
• transform includes lowercase where applicable.
• No match.value contains capital letters.
• The rule uses contains instead of regex for the body pattern, as only a substring match is needed.

[github-actions]

Hello @crowdsec-automation and thank you for your contribution!

❗ It seems that the following scenarios are not part of the 'crowdsecurity/appsec-virtual-patching' collection:

🔴 crowdsecurity/vpatch-CVE-2024-28752 🔴

[github-actions]

Hello @crowdsec-automation,

Scenarios/AppSec Rule are compliant with the taxonomy, thank you for your contribution!

[he2ss]

too generic/complicated