[Snort-sigs] New sig for detecting OTRS Installation Dialog (after auth)

rmkml rmkml at ...4129...
Thu Jun 8 15:35:49 EDT 2017


Hi,

Please check a new sig for detecting OTRS Installation Dialog (after auth) attempt:

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-PERL OTRS Installation Dialog (after auth) attempt"; 
flow:to_server,established; content:"/otrs/index.pl?Action=Installer"; nocase; http_uri;
classtype:web-application-activity; reference:cve,2017-9324; sid:1; rev:1; )

Don't forget check variables.

Please send any comments.

Regards
@Rmkml




More information about the Snort-sigs mailing list