frack113
38 lines
1.3 KiB
YAML
38 lines
1.3 KiB
YAML
title: Potential CVE-2021-27905 Exploitation Attempt
|
|
id: 0bbcd74b-0596-41a4-94a0-4e88a76ffdb3
|
|
status: experimental
|
|
description: Detects exploitation attempt of the CVE-2021-27905 which affects all Apache Solr versions prior to and including 8.8.1.
|
|
references:
|
|
- https://twitter.com/Al1ex4/status/1382981479727128580
|
|
- https://twitter.com/sec715/status/1373472323538362371
|
|
- https://nsfocusglobal.com/apache-solr-arbitrary-file-read-and-ssrf-vulnerability-threat-alert/
|
|
- https://mp.weixin.qq.com/s?__biz=Mzg3NDU2MTg0Ng==&mid=2247484117&idx=1&sn=2fdab8cbe4b873f8dd8abb35d935d186
|
|
- https://github.com/murataydemir/CVE-2021-27905
|
|
author: '@gott_cyber'
|
|
date: 2022/12/11
|
|
modified: 2023/01/02
|
|
tags:
|
|
- attack.initial_access
|
|
- attack.t1190
|
|
- cve.2021.27905
|
|
logsource:
|
|
category: webserver
|
|
detection:
|
|
selection_request1:
|
|
cs-uri-query|contains|all:
|
|
- '/solr/'
|
|
- '/debug/dump?'
|
|
- 'param=ContentStream'
|
|
sc-status: '200'
|
|
selection_request2:
|
|
cs-method: 'GET'
|
|
cs-uri-query|contains|all:
|
|
- '/solr/'
|
|
- 'command=fetchindex'
|
|
- 'masterUrl='
|
|
sc-status: '200'
|
|
condition: 1 of selection_*
|
|
falsepositives:
|
|
- Vulnerability Scanners
|
|
level: medium
|