ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
    msg:"ET WEB_SPECIFIC_APPS Jenkins Chained Exploits CVE-2018-1000861 and CVE-2019-1003000 M2";
    flow:established,to_server;
    http.method;
    content:"GET"; depth:3;
    http.uri;
    content:"/securityRealm/user/"; depth:20; fast_pattern;
    content:"descriptorByName/"; distance:0;
    content:"checkScript"; distance:0;
    content:"|40|ASTTest"; distance:0;
    content:"Runtime|2e|getRuntime|28 29 2e|exec|28 22|"; distance:0;
    content:"|22 29 7d 29 0a|"; distance:0;
    http.header_names;
    content:!"Referer";
    reference:cve,2018-1000861;
    reference:cve,2019-1003000;
    reference:url,blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html;
    reference:url,blog.orange.tw/2019/01/hacking-jenkins-part-1-play-with-dynamic-routing.html;
    classtype:web-application-attack;
    sid:2027350; rev:3;
    metadata:attack_target Server, created_at 2019_05_10, cve CVE_2018_100086, deployment Perimeter, performance_impact Low, signature_severity Major, tag CISA_KEV, updated_at 2020_08_28;
)