ET EXPLOIT Possible Successful VMware Cloud Director RCE Attempt (CVE-2020-3956)

7.0.3 5.0SID: 2030241Rev: 3Enabled1 views

Fileemerging-exploit.rules

CreatedJune 2, 2020

UpdatedMarch 14, 2024

Classificationattempted-admin

alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Possible Successful VMware Cloud Director RCE Attempt (CVE-2020-3956)"; flow:established,to_client; flowbits:isset,ET.20203956; http.stat_code; content:"400"; http.response_body; content:"<Error"; content:"has|20|invalid|20|length|20|for"; fast_pattern; reference:url,citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/; classtype:attempted-admin; sid:2030241; rev:3; metadata:affected_product VMware, attack_target Server, created_at 2020_06_02, cve CVE_2020_3956, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_14;)

References

url	citadelo.com/en/blog/full-infrastructure-takeover-of-vmware-cloud-director-CVE-2020-3956/

Metadata

affected productVMware

attack targetServer

created at2020_06_02

cve

CVE-2020-3956

deploymentPerimeter

performance impactLow

confidenceMedium

signature severityMajor

tagDescription_Generated_By_Proofpoint_Nexus

updated at2024_03_14

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!