""ET WEB_SPECIFIC_APPS Possible CVE-2020-8518 (Horde Groupware RCE)""

SID: 2029636

Revision: 3

Class Type: attempted-admin

Metadata: attack_target Web_Server, created_at 2020_03_13, cve CVE_2020_8518, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2020_11_12

Reference:

  • cve

  • 2020-8518

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "data.php"

  • Value: "|22 3b 20|filename=|22|"

  • Value: "|2e|passthru|28|"

  • Value: "|2e|die|28 29 3b|"

  • Value: "horde_secret_key|3a 20|"

Within:

PCRE: "/data.php$/Ui"

Special Options:

  • http_method

  • http_uri

  • nocase

  • http_client_body

  • http_client_body

  • http_client_body

  • nocase

  • fast_pattern

  • http_header

source