""ET WEB_SERVER Apache Tomcat Boundary Overflow DOS/File Upload Attempt""

SID: 2018113

Revision: 1

Class Type: web-application-attack

Metadata: created_at 2014_02_12, cve CVE_2014_0050, updated_at 2014_02_12

Reference:

  • cve

  • 2014-0050

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HTTP_SERVERS

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "multipart/form-data"

  • Value: "Content-Type|3A|"

  • Value: !"|0A|"

Within: 4091

PCRE: "/^[^\r\n]?boundary\s?=\s*?[^\r\n]/Ri"

Special Options:

  • http_method

  • http_header

  • nocase

source