""ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (mvg)""

SID: 2022789

Revision: 3

Class Type: web-application-attack

Metadata: created_at 2016_05_04, cve CVE_2016_3714, updated_at 2016_05_19

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HTTP_SERVERS

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "viewbox "

Within:

PCRE: "/https\x3a.+(?<!\x5c)(:[\x22\x27]|\x2[27])\s?[\x3b&\x7c><].?(:[\x22\x27]|\x2[27])/Psi"

Special Options:

  • nocase

  • http_client_body

source