Rule History

SID: 2049666 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 1 • Dec 12, 2023, 12:00 PM

Message:

ET WEB_SPECIFIC_APPS pfSense CE 2.7.0 Stored Cross Site Script Attempt - getservicesproviders.php connection parameter (CVE-2023-42327)

Rule:

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS pfSense CE 2.7.0 Stored Cross Site Script Attempt - getservicesproviders.php connection parameter (CVE-2023-42327)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/getserviceproviders.php"; fast_pattern; http.request_body; content:"__csrf_magic|3d|"; startswith; content:"connection|3d|"; content:"|22 3b|"; distance:0; within:50; content:"|2f 2f|"; distance:0; within:150; reference:url,www.sonarsource.com/blog/pfsense-vulnerabilities-sonarcloud/; reference:cve,2023-42327; classtype:attempted-admin; sid:2049666; rev:1; metadata:attack_target Networking_Equipment, created_at 2023_12_12, cve CVE_2023_42327, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, updated_at 2023_12_12, reviewed_at 2024_10_03; target:dest_ip;)

Created:

Dec 12, 2023, 12:00 PM

Updated:

Dec 12, 2023, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

Sep 21, 2024, 3:00 AM

Filename:

rules/emerging-web_specific_apps.rules