Rule History

SID: 2051668 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 1 • Mar 15, 2024, 12:00 PM

Message:

ET WEB_SPECIFIC_APPS Contec SolarView Compact downloader.php Command Injection Attempt (CVE-2023-23333)

Rule:

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Contec SolarView Compact downloader.php Command Injection Attempt (CVE-2023-23333)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/downloader.php?file|3d 3b|"; fast_pattern; startswith; reference:url,attackerkb.com/topics/kE3lzTZGV2/cve-2023-23333; reference:cve,2023-23333; classtype:attempted-admin; sid:2051668; rev:1; metadata:affected_product CONTEC_SolvarView, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_03_15, cve CVE_2023_23333, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_03_15, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services; target:dest_ip;)

Created:

Mar 15, 2024, 12:00 PM

Updated:

Mar 15, 2024, 12:00 PM

DB Created:

Mar 15, 2024, 9:00 PM

DB Updated:

Mar 15, 2024, 9:00 PM

Filename:

rules/emerging-web_specific_apps.rules