Linux_Exploit_CVE_2022_22965_32d3fcd0

rule Linux_Exploit_CVE_2022_22965_32d3fcd0 {
    meta:
        author = "Elastic Security"
        id = "32d3fcd0-ef4f-4fa3-8d4a-02791d7d8ff8"
        fingerprint = "11865042f9bd5a88e1bcdaa149b10e02725afb7335b4c7255c9f0e1faaf5b46c"
        creation_date = "2022-12-15"
        last_modified = "2026-05-22"
        threat_name = "Linux.Exploit.CVE-2022-22965"
        reference_sample = "f9fc370955490bdf38fc63ca0540ce1ea6f7eca5123aa4eef730cb618da8551f"
        severity = 100
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "linux"
    strings:
        $bot_a_1 = "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%{c2}i if"
        $bot_b_1 = "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if"
        $bot_a_2 = "(\"j\".equals(request.getParameter(\"pwd\"))){ java.io.InputStream in = %2"
        $bot_b_2 = "(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%2"
        $bot_a_3 = "5{c1}i.getRuntime().exec(request.getParameter(\"cmd\")).getInputStream(); int "
        $bot_b_3 = "5%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20"
        $bot_a_4 = "a = -1; byte[] b = new byte[2048]; while((a=in.read(b))!"
        $bot_b_4 = "a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))!"
        $bot_a_5 = "%3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.cl"
        $bot_b_5 = "=-1){ out.println(new String(b)); } } %{suffix}i&class.module.cl"
        $bot_c_6 = "assLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.res"
        $bot_c_7 = "ources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resou"
        $bot_c_8 = "rces.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.con"
        $bot_c_9 = "text.parent.pipeline.first.fileDateFormat="
    condition:
        3 of ($bot_c_*) and (3 of ($bot_a_*) or 3 of ($bot_b_*))
}