""ET ATTACK_RESPONSE Possible CVE-2021-44228 Payload via LDAPv3 Response M2""

SID: 2034769

Revision: 2

Class Type: attempted-admin

Metadata: created_at 2021_12_20, cve CVE_2021_44228, updated_at 2021_12_20

Reference:

  • cve

  • 2021-44228

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: [$HOME_NET,$HTTP_SERVERS]

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "|30|" Depth: 1

  • Value: "|04 0d|javaClassName"

  • Value: "|04|"

  • Value: "|04 12|javaSerializedData"

  • Value: "|ac ed|"

  • Value: "|2e|exec"

  • Value: "FromCharCode"

Within: 10

PCRE:

Special Options:

  • fast_pattern

  • nocase

source