""ET WEB_CLIENT Possible Confluence SSTI Exploitation Attempt - Leads to RCE/LFI (CVE-2019-3396)""

SID: 2027333

Revision: 2

Class Type: attempted-admin

Metadata: created_at 2019_05_08, cve CVE_2019_3396, deployment Perimeter, deployment Internal, performance_impact Low, signature_severity Major, updated_at 2019_05_08

Reference:

• Link

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HTTP_SERVERS

Destination Port: any

Flow: established,to_server

Contents:

• Value: "POST"

• Value: "/rest/tinymce/1/macro/preview"

• Value: "|22|contentId|22|" Depth: 20

• Value: "|22|_template|22 3a|"

Within:

PCRE: "/^\/rest\/tinymce\/1\/macro\/preview$/U"

Special Options:

• http_method

• http_uri

• http_client_body

• http_client_body

source