ET EXPLOIT Possible Redis RCE Attempt - Dynamic Importing of liblua (CVE-2022-0543) - Suricata Rule 2035720 (et/open)

ET EXPLOIT Possible Redis RCE Attempt - Dynamic Importing of liblua (CVE-2022-0543)

SID: 2035720Rev: 20 viewsHistory

Sourceet/open

CreatedApril 4, 2022

UpdatedApril 4, 2022

Classificationattempted-admin

alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT Possible Redis RCE Attempt - Dynamic Importing of liblua (CVE-2022-0543)"; flow:established,to_server; content:"package|2e|loadlib|28|"; fast_pattern; content:"liblua"; within:500; reference:url,blogs.juniper.net/en-us/security/muhstik-gang-targets-redis-servers; reference:url,www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce; reference:cve,2022-0543; classtype:attempted-admin; sid:2035720; rev:2; metadata:affected_product Redis, created_at 2022_04_04, cve CVE_2022_0543, confidence Medium, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_04_04;)

References

url	blogs.juniper.net/en-us/security/muhstik-gang-targets-redis-servers
url	www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce
cve	2022-0543

Metadata

affected productRedis

created at2022_04_04

cveCVE-2022-0543

confidenceMedium

signature severityMajor

tagDescription_Generated_By_Proofpoint_Nexus

updated at2022_04_04

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!