ET HUNTING Microsoft Windows MSHTML Platform Remote Code Execution (CVE-2023-35628)

SID: 2059362Rev: 198 views
Sourceet/open
CreatedJanuary 21, 2025
UpdatedJanuary 21, 2025
Classificationbad-unknown
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Microsoft Windows MSHTML Platform Remote Code Execution (CVE-2023-35628)"; flow:established,to_client; http.response_body; content:"file|3a 2f 2f 2e 2f|UNC|2f|C|3a 2f|"; reference:url,www.akamai.com/blog/security-research/critical-vulnerability-create-uri-remote-code-execution; reference:cve,2023-35628; classtype:bad-unknown; sid:2059362; rev:1; metadata:affected_product Windows_11, affected_product Windows_Server_2019, affected_product Windows_Server_2022, affected_product Windows_Server_2016, affected_product Windows_10, affected_product Windows_Server_2012, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2025_01_21, cve CVE_2023_35628, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Major, updated_at 2025_01_21; target:dest_ip;)

References

urlwww.akamai.com/blog/security-research/critical-vulnerability-create-uri-remote-code-execution
cve2023-35628

Metadata

affected productWindows_Server_2012
attack targetClient_Endpoint
tls stateTLSDecrypt
created at2025_01_21
deploymentSSLDecrypt
confidenceMedium
signature severityMajor
updated at2025_01_21

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!