""ET EXPLOIT WinRAR WinAce Containing CVE-2018-20250 Inbound - Path Traversal leading to RCE""

SID: 2027310

Revision: 2

Class Type: trojan-activity

Metadata: attack_target Client_Endpoint, created_at 2019_05_01, cve CVE_2018_20250, deployment Perimeter, performance_impact Moderate, signature_severity Major, tag WinRAR, tag ACE, updated_at 2019_05_01

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,from_server

Contents:

• Value: "200"

• Value: "ACE" Depth: 7 Offset: 7

• Value: "|00|"

Within:

PCRE: "/^(?:(\S\:\){2,}|\S\:\\S\:\S\:|S\:\\\([0-9]{1,3}.){3}[0-9]{1,3}|\S\:\\\([a-z0-9-]{1,30}.){1,8}[a-z]{1,8})/R"

Special Options:

• http_stat_code

• file_data

• fast_pattern

source