""ET WEB_SPECIFIC_APPS Symantec Endpoint Manager XXE RCE Attempt""

SID: 2018176

Revision: 3

Class Type: web-application-attack

Metadata: created_at 2014_02_26, cve CVE_2013_5014, updated_at 2014_02_26

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: [8443,9090]

Flow: established,to_server

Contents:

  • Value: "POST " Depth: 5

  • Value: "/servlet/ConsoleServlet?ActionType=ConsoleLog"

  • Value: "Content-Type|3a| text/xml|0d 0a|"

  • Value: "|3c 21|DOCTYPE"

  • Value: "http|3a|//127.0.0.1|3a|9090/servlet/ConsoleServlet?ActionType=ConfigServer&action=test_av&SequenceNum="

  • Value: "&Parameter="

Within:

PCRE:

Special Options:

  • nocase

  • nocase

  • nocase

  • nocase

source