ET WEB_SERVER Nagios statuswml.cgi Remote Arbitrary Shell Command Injection attempt

7.0.35.0SID: 2009670Rev: 14Enabled1 views
Sourceet/open
Fileemerging-web_server.rules
CreatedJuly 30, 2010
UpdatedMarch 6, 2024
Classificationweb-application-attack
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Nagios statuswml.cgi Remote Arbitrary Shell Command Injection attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/statuswml.cgi?"; nocase; content:"ping"; nocase; pcre:"/^\s*=\s*([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|[^\x26\x0D\x0A]*\x3B)/Ri"; reference:bugtraq,35464; classtype:web-application-attack; sid:2009670; rev:14; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_03_06, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services;)

References

bugtraq35464

Metadata

created at2010_07_30
signature severityMajor
updated at2024_03_06
mitre tactic idTA0008
mitre tactic nameLateral_Movement
mitre technique idT1210
mitre technique nameExploitation_Of_Remote_Services

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!