title: CVE-2021-21978 Exploitation Attempt
id: 77586a7f-7ea4-4c41-b19c-820140b84ca9
status: experimental
description: Detects the exploitation of the VMware View Planner vulnerability described in CVE-2021-21978
author: Bhabesh Raj
date: 2020/03/10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-21978
    - https://twitter.com/wugeej/status/1369476795255320580
    - https://paper.seebug.org/1495/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21978
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains|all: 
            - 'logupload'
            - 'logMetaData'
            - 'wsgi_log_upload.py'
    condition: selection
fields:
    - c-ip
    - c-dns
falsepositives:
    - None
level: high
tags:
    - attack.initial_access
    - attack.t1190
