""ET EXPLOIT Adobe Coldfusion BlazeDS Java Object Deserialization Remote Code Execution""

SID: 2025836

Revision: 2

Class Type: attempted-user

Metadata: attack_target Server, created_at 2018_07_13, cve CVE_2017_3066, deployment Datacenter, performance_impact Low, signature_severity Major, updated_at 2018_07_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application

Reference:

• cve

• 2017-3066

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HTTP_SERVERS

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "/amf"

• Value: "sun.rmi.server.UnicastRef"

• Value: "|f9 6a 76 7b 7c de 68 4f 76 d8 aa 3d 00 00 01 5b b0 4c 1d 81 80 01 00|"

Within:

PCRE:

Special Options:

• http_uri

• http_client_body

• fast_pattern

source