""ET EXPLOIT [ConnectWise CRU] Potential Sonicwall SMA User-Level Authentication Bypass (sslvpnclient) (CVE-2021-20016)""

SID: 2033346

Revision: 2

Class Type: web-application-attack

Metadata: attack_target Networking_Equipment, created_at 2021_07_16, cve CVE_2021_20016, deployment Perimeter, deployment SSLDecrypt, signature_severity Major, updated_at 2021_07_16

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "/cgi-bin/sslvpnclient"

  • Value: !"/api/v1/logon"

  • Value: !"/cgi-bin/userLogin"

Within:

PCRE: "/^Referer\x3a\x20[^\r\n]+\/cgi-bin\/userLogin/Hmi"

Special Options:

  • http_uri

  • http_header

source