""ET EXPLOIT Possible SolarWinds Orion RCE Inbound (CVE-2021-31474)""

SID: 2033035

Revision: 2

Class Type: attempted-admin

Metadata: attack_target Server, created_at 2021_05_27, cve CVE_2021_31474, deployment Perimeter, deployment Internal, deployment SSLDecrypt, signature_severity Major, updated_at 2021_05_27

Reference:

• cve

• 2021-31474

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "POST"

• Value: "/api/Action/TestAction"

• Value: "$type|22 3a 20 22|System.Byte|5b 5d|,|20|mscorlib"

• Value: "$value|22 3a 20 22|"

Within:

PCRE: "/^(?:[A-Z0-9+/]{4})*(?:[A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})/R"

Special Options:

• http_method

• http_uri

• fast_pattern

• http_client_body

• http_client_body

source