ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
    msg:"ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M1";
    flow:established,to_server;
    http.method;
    content:"GET"; depth:3;
    http.uri;
    content:"/securityRealm/user/"; depth:20; fast_pattern;
    content:"descriptorByName/"; distance:0;
    content:"checkScriptCompile"; distance:0;
    content:"value=|40|GrabConfig"; distance:0;
    content:"|40|GrabResolver|28|"; distance:0;
    content:"|27|http"; within:60;
    content:"|27 29 0a 40|Grab|28|"; distance:0;
    http.header_names;
    content:!"Referer";
    reference:cve,2018-1000861;
    reference:cve,2019-1003000;
    reference:url,blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html;
    reference:url,blog.orange.tw/2019/01/hacking-jenkins-part-1-play-with-dynamic-routing.html;
    classtype:web-application-attack;
    sid:2027349; rev:5;
    metadata:attack_target Server, created_at 2019_05_10, cve CVE_2018_100086, deployment Perimeter, performance_impact Low, signature_severity Major, tag CISA_KEV, updated_at 2020_11_19;
)