ET WEB_SPECIFIC_APPS OGNL Expression Injection (CVE-2017-9791)

alert http any any -> $HTTP_SERVERS any (
    msg:"ET WEB_SPECIFIC_APPS OGNL Expression Injection (CVE-2017-9791)";
    flow:established,to_server;
    http.method;
    content:"POST"; nocase;
    http.request_body;
    content:"multipart";
    content:"form-data"; distance:1; within:11;
    content:"ognl.OgnlContext"; distance:1; fast_pattern;
    content:"DEFAULT_MEMBER_ACCESS"; distance:1; within:23;
    content:"java.lang.ProcessBuilder"; distance:1;
    content:".start"; distance:1;
    reference:url,securityonline.info/tutorial-cve-2017-9791-apache-struts2-s2-048-remote-code-execution-vulnerability/;
    reference:cve,2017-9791;
    classtype:attempted-user;
    sid:2024468; rev:3;
    metadata:affected_product Apache_Struts2, attack_target Web_Server, created_at 2017_07_14, cve CVE_2017_9791, deployment Datacenter, performance_impact Low, confidence High, signature_severity Major, tag CISA_KEV, updated_at 2020_08_10;
)