Rule History

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Citrix/Netscaler ADC and NetScaler Gateway RCE Attempt CVE-2023-3519"; flow:established,to_server; http.uri; content:"/gwtest/formss"; fast_pattern; content:"event=st"; pcre:"/^(?:op|art)(?:&|$)/Ri"; content:"target="; isdataat:100; content:!"&"; within:100; reference:url,blog.assetnote.io/2023/07/24/citrix-rce-part-2-cve-2023-3519/; reference:cve,2023-3519; classtype:attempted-admin; sid:2046885; rev:1; metadata:affected_product Citrix, affected_product Netscaler, created_at 2023_07_24, cve CVE_2023_3519, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2023_07_24; target:dest_ip;)