Rule History

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution"; flow:established,to_server; http.uri; content:"/init.do?"; content:"java.util"; content:"Runtime.getRuntime().exec"; fast_pattern; content:"cmd"; reference:url,exploit-db.com/exploits/44292/; reference:cve,2018-2380; classtype:attempted-user; sid:2025835; rev:3; metadata:attack_target Web_Server, created_at 2018_07_12, cve CVE_2018_2380, deployment Datacenter, performance_impact Low, confidence Medium, signature_severity Major, updated_at 2020_08_25;)