Rule History

SID: 2025840 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 3 • Jul 16, 2018, 12:00 PM

Message:

ET WEB_SPECIFIC_APPS Hadoop YARN ResourceManager Unauthenticated Command Execution

Rule:

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Hadoop YARN ResourceManager Unauthenticated Command Execution"; flow:established,to_server; http.uri; content:"/ws/v1/cluster/apps"; fast_pattern; http.request_body; content:"|22|application-type|22 3a 22|YARN|22|"; content:"|22 3a 7b 22|commands|22 3a 7b 22|command|22 3a 22|"; pcre:"/(?:f0VM|9FT|\/RU)/R"; content:"base64"; reference:url,exploit-db.com/exploits/45025/; classtype:attempted-user; sid:2025840; rev:3; metadata:attack_target Web_Server, created_at 2018_07_16, deployment Datacenter, performance_impact Low, confidence High, signature_severity Major, updated_at 2020_08_25;)

Created:

Jul 16, 2018, 12:00 PM

Updated:

Aug 25, 2020, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-web_specific_apps.rules