ET WEB_SPECIFIC_APPS Altenergy Power Control Software Command Injection Attempt (CVE-2022-25237)
Sourceet/open
CreatedMarch 28, 2023
UpdatedMarch 29, 2023
Classificationattempted-admin
alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET WEB_SPECIFIC_APPS Altenergy Power Control Software Command Injection Attempt (CVE-2022-25237)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/management/set_timezone"; fast_pattern; endswith; http.request_body; content:"timezone="; pcre:"/^[^&]{0,50}(?:%60|%24|%3B)/PRi"; reference:url,github.com/superzerosec/CVE-2023-28343; reference:cve,2023-28343; classtype:attempted-admin; sid:2044825; rev:1; metadata:affected_product HTTP_Server, attack_target Server, created_at 2023_03_28, cve CVE_2022_25237, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_29, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services;)
References
Metadata
affected productHTTP_Server
attack targetServer
created at2023_03_28
deploymentPerimeter
confidenceHigh
signature severityMajor
tagDescription_Generated_By_Proofpoint_Nexus
updated at2023_03_29
mitre tactic idTA0008
mitre tactic nameLateral_Movement
mitre technique idT1210
mitre technique nameExploitation_Of_Remote_Services
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!