""ET WEB_SPECIFIC_APPS Apache Struts2 uploadFileName Directory Traversal Attempt (CVE-2023-50164) M1""

SID: 2049667

Revision: 2

Class Type: attempted-admin

Metadata: affected_product Apache_Struts2, attack_target Web_Server, created_at 2023_12_12, cve CVE_2023_50164, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_05_21

Reference:

• cve

• 2023-50164

Protocol: tcp

Source Network: any

Source Port: any

Destination Network: $HOME_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "POST"

• Value: "/upload.action"

• Value: "Content-Disposition|3a 20|form-data|3b 20|name|3d 22|"

• Value: "uploadFileName|22|"

Within:

PCRE: "/(\x2e\x2e\x2f|\x252e\x252e\x252f)/Pi"

Special Options:

• http_method

• http_uri

• http_client_body

• http_client_body

• nocase

• fast_pattern

source