""ET EXPLOIT OpenTSDB RCE in HTTP Request M3 (CVE-2023-25826)""

SID: 2052825

Revision: 1

Class Type: trojan-activity

Metadata: affected_product OpenTSDB, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_05_22, cve CVE_2023_25826, deployment Perimeter, confidence Medium, signature_severity Major, updated_at 2024_05_22

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_server

Contents:

  • Value: "GET"

  • Value: "|2f|q|3f|" Depth: 3

  • Value: "start="

  • Value: "&m="

  • Value: "|3a|"

  • Value: "&o="

  • Value: "&wxh="

  • Value: "&smooth="

  • Value: "&json"

Within:

PCRE: "/&json$/U"

Special Options:

  • http_method

  • http_uri

  • fast_pattern

  • http_uri

  • http_uri

  • http_uri

  • http_uri

  • http_uri

  • http_uri

  • http_uri

source