ET WEB_SPECIFIC_APPS Possible JBoss JMX Console Beanshell Deployer WAR Upload and Deployment Exploit Attempt

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
    msg:"ET WEB_SPECIFIC_APPS Possible JBoss JMX Console Beanshell Deployer WAR Upload and Deployment Exploit Attempt";
    flow:established,to_server;
    http.uri;
    content:"/HtmlAdaptor"; nocase;
    content:"action=inspect"; nocase;
    content:"bean"; nocase;
    content:"name=";
    reference:url,www.redteam-pentesting.de/en/publications/jboss/-bridging-the-gap-between-the-enterprise-and-you-or-whos-the-jboss-now;
    reference:cve,2010-0738;
    classtype:web-application-attack;
    sid:2011696; rev:6;
    metadata:created_at 2010_07_30, cve CVE_2010_0738, confidence Medium, signature_severity Major, updated_at 2020_09_11;
)