""ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638)""
SID: 2024038
Revision: 2
Class Type: web-application-attack
Metadata: affected_product Apache_Struts2, attack_target Web_Server, created_at 2017_03_08, cve CVE_2017_5638, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2017_03_08
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: any
Destination Network: $HTTP_SERVERS
Destination Port: $HTTP_PORTS
Flow: to_server,established
Contents:
-
Value: "ProcessBuilder"
-
Value: "apache"
-
Value: "struts"
Within:
PCRE: "/^Content-Type\x3a\x20(?=[^\r\n]?ProcessBuilder)[^\r\n]?.struts/Hmi"
Special Options:
-
http_header
-
http_header
-
nocase
-
http_header