Rule History

alert http any any -> any any (msg: "ATTACK [PTsecurity] Apache Struts < 2.3.32 < 2.5.10.1 RCE through Jakarta Multipart parser Attempt"; flow: established, to_server; content: "%{"; fast_pattern; http_header; content: "multipart/form-data"; http_header; content: "#_memberAccess"; http_header; content: "@java"; http_header; reference: cve, 2017-5638; reference: url, paper.seebug.org/241/; reference: url, rules.ptsecurity.com; classtype: attempted-admin; sid: 10001065; rev: 3;)