""ET EXPLOIT Ruckus vRIoT Command Injection Attempt Inbound (CVE-2020-26878)""
SID: 2031114
Revision: 2
Class Type: attempted-user
Metadata: affected_product IoT, created_at 2020_10_26, cve CVE_2020_26878, deployment Perimeter, deployment Internal, performance_impact Low, signature_severity Major, updated_at 2020_10_26, mitre_tactic_id TA0008, mitre_tactic_name Lateral_Movement, mitre_technique_id T1210, mitre_technique_name Exploitation_Of_Remote_Services
Reference:
-
cve
-
2020-26878
Protocol: tcp
Source Network: any
Source Port: any
Destination Network: [$HTTP_SERVERS,$HOME_NET]
Destination Port: $HTTP_PORTS
Flow: established,to_server
Contents:
-
Value: "POST"
-
Value: "/service/v1/createUser" Depth: 22
-
Value: "|22|username|22|"
-
Value: "|3a 20|"
-
Value: "Content-Type|3a 20|application/json"
Within:
PCRE: "/^\x22[^\x22]\x3b[^\x22]\x22/R"
Special Options:
-
http_method
-
http_uri
-
fast_pattern
-
http_client_body
-
http_client_body
-
http_header