Rule History

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache Flink Arbitrary File Read Attempt (CVE-2020-17519)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/jobmanager/logs/"; fast_pattern; startswith; http.uri.raw; pcre:"/^\/jobmanager\/logs\/\x2e\x2e%252f/"; reference:cve,2020-17519; reference:url,attackerkb.com/topics/t2rkmB0Uem/cve-2020-17519/vuln-details; classtype:attempted-recon; sid:2053042; rev:1; metadata:affected_product Apache_Flink, attack_target Web_Server, tls_state plaintext, created_at 2024_05_30, cve CVE_2020_17519, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag CISA_KEV, updated_at 2024_05_30;)