Rule History

SID: 2024038 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 4 • Mar 8, 2017, 12:00 PM

Message:

ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638)

Rule:

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638)"; flow:established,to_server; http.header; content:"apache"; http.content_type; content:"ProcessBuilder"; content:".struts"; distance:0; reference:cve,2017-5638; reference:url,github.com/rapid7/metasploit-framework/issues/8064; classtype:web-application-attack; sid:2024038; rev:4; metadata:affected_product Apache_Struts2, attack_target Web_Server, created_at 2017_03_08, cve CVE_2017_5638, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2020_08_20;)

Created:

Mar 8, 2017, 12:00 PM

Updated:

Aug 20, 2020, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-web_specific_apps.rules