ATTACK [PTsecurity] Cookieless string in ASP.NET (CVE-2023-36899)

SID: 10009357Rev: 3Enabled33 views

Fileptopen-attacks.rules

CreatedJuly 24, 2025

UpdatedJuly 24, 2025

Classificationattempted-admin

alert http any any -> any any (msg:"ATTACK [PTsecurity] Cookieless string in ASP.NET (CVE-2023-36899)"; flow:established, to_server; http.uri; content:"/("; fast_pattern; content:"))"; distance:0; pcre:"/\/\([A-Z]\(.*?\)\).*?\)\)/"; reference:url, soroush.me/blog/2023/08/cookieless-duodrop-iis-auth-bypass-app-pool-privesc-in-asp-net-framework-cve-2023-36899; reference:cve, 2023-36899; reference:url, rules.ptsecurity.com; classtype:attempted-admin; sid:10009357; rev:3;)

References

url	soroush.me/blog/2023/08/cookieless-duodrop-iis-auth-bypass-app-pool-privesc-in-asp-net-framework-cve-2023-36899
cve	2023-36899
url	rules.ptsecurity.com

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!