""ET EXPLOIT Sonicwall Unauthenticated Stack-Based Buffer Overflow (CVE-2021-20038)""

SID: 2034970

Revision: 2

Class Type: attempted-admin

Metadata: affected_product Apache_HTTP_server, attack_target Server, created_at 2022_01_25, cve CVE_2021_20038, deployment Perimeter, confidence High, signature_severity Major, updated_at 2022_01_25

Reference:

  • cve

  • 2021-20038

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "GET"

  • Value: "|2f 04 3f 7f 3f 18 3f 7f 3f 18 3f 7f 3f 64 3f 06 08 3b|" Depth: 18

  • Value: "|3b 3f|"

  • Value: !"Referer|3a 20|"

Within:

PCRE:

Special Options:

  • http_method

  • http_uri

  • fast_pattern

  • http_uri

  • http_header

source