""ET WEB_SPECIFIC_APPS Possible Apache Druid RCE Inbound (CVE-2021-25646)""

SID: 2032340

Revision: 2

Class Type: attempted-admin

Metadata: affected_product Apache_HTTP_server, attack_target Server, created_at 2021_03_29, cve CVE_2021_25646, deployment Perimeter, deployment Internal, signature_severity Major, updated_at 2021_03_29

Reference:

  • cve

  • 2021-25646

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: [$HTTP_SERVERS,$HOME_NET]

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "POST"

  • Value: "|22|type|22 3a 20 22|javascript|22|"

  • Value: "|22|function|22 3a 20|"

Within:

PCRE: "/^\x22[^\x22]\x7b[^\x22]\x7d[^\x22]\x22[^\x22]\x22{2}/Rm"

Special Options:

  • http_method

  • http_client_body

  • fast_pattern

  • http_client_body

source