""ET WEB_SPECIFIC_APPS Possible Drupal Object Unserialize Exploit Attempt""

SID: 2024039

Revision: 1

Class Type: web-application-attack

Metadata: affected_product Drupal_Server, attack_target Server, created_at 2017_03_08, deployment Datacenter, performance_impact Moderate, signature_severity Minor, updated_at 2017_03_08

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HTTP_SERVERS

Destination Port: $HTTP_PORTS

Flow: to_server,established

Contents:

  • Value: "POST"

  • Value: "/user/login"

  • Value: "Content-Type|3a 20|application/vnd.php.serialized|0d 0a|"

  • Value: "username"

  • Value: "SelectQuery"

Within:

PCRE:

Special Options:

  • http_method

  • http_uri

  • http_header

  • http_client_body

  • http_client_body

source