title: CVE-2021-21978 Exploitation Attempt
id: 77586a7f-7ea4-4c41-b19c-820140b84ca9
status: test
description: Detects the exploitation of the VMware View Planner vulnerability described in CVE-2021-21978
author: Bhabesh Raj
references:
  - https://twitter.com/wugeej/status/1369476795255320580
  - https://paper.seebug.org/1495/
date: 2020/03/10
modified: 2021/11/27
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    c-uri|contains|all:
      - 'logupload'
      - 'logMetaData'
      - 'wsgi_log_upload.py'
  condition: selection
fields:
  - c-ip
  - c-dns
falsepositives:
  - Unknown
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2021.21978
