ET EXPLOIT dotCMS Arbitrary File Upload Attempt (CVE-2022-26352) M2

alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (
    msg:"ET EXPLOIT dotCMS Arbitrary File Upload Attempt (CVE-2022-26352) M2";
    flow:established,to_server;
    http.request_line;
    content:"PUT|20|/api/content/|20|"; startswith; fast_pattern;
    http.content_type;
    content:"multipart/form-data|3b|"; startswith;
    http.request_body;
    content:"filename=|22 2e 2e 2f|";
    reference:url,blog.assetnote.io/2022/05/03/hacking-a-bank-using-dotcms-rce/;
    reference:url,www.dotcms.com/security/SI-62;
    reference:cve,2022-26352;
    classtype:attempted-admin;
    sid:2036458; rev:1;
    metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2022_05_04, cve CVE_2022_26352, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_05_04;
)