alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Sonicwall Unauthenticated Stack-Based Buffer Overflow (CVE-2021-20038)"; flow:established,to_server; http.method; content:"GET"; http.uri; bsize:>200; content:"|2f 04 3f 7f 3f 18 3f 7f 3f 18 3f 7f 3f 64 3f 06 08 3b|"; startswith; fast_pattern; content:"|3b 3f|"; distance:0; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; reference:url,psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0026; reference:cve,2021-20038; classtype:attempted-admin; sid:2034970; rev:5; metadata:affected_product Apache_HTTP_server, attack_target Server, created_at 2022_01_25, cve CVE_2021_20038, deployment Perimeter, deprecation_reason Relevance, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_12_02, reviewed_at 2024_12_02;)