alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT GitLab Pre-Auth RCE Detected (CVE-2021-22205)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/uploads/user"; bsize:13; http.header_names; content:"X-CSRF-Token"; http.request_body; content:"AT&TFORM"; fast_pattern; content:"DJV"; distance:0; within:8; content:"ANT"; distance:0; content:"(metadata"; distance:0; content:"|5c 0a|"; distance:0; content:"|5c 0a|"; distance:0; reference:url,devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html,url,hackerone.com/reports/1154542; classtype:trojan-activity; sid:2044201; rev:2; metadata:attack_target Client_and_Server, created_at 2023_02_14, cve CVE_2021_22205, deployment Perimeter, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_04_06;)