ET EXPLOIT GitLab Pre-Auth RCE Detected (CVE-2021-22205)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET EXPLOIT GitLab Pre-Auth RCE Detected (CVE-2021-22205)";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:"/uploads/user"; bsize:13;
    http.header_names;
    content:"X-CSRF-Token";
    http.request_body;
    content:"AT&TFORM"; fast_pattern;
    content:"DJV"; distance:0; within:8;
    content:"ANT"; distance:0;
    content:"(metadata"; distance:0;
    content:"|5c 0a|"; distance:0;
    content:"|5c 0a|"; distance:0;
    reference:url,devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html,url,hackerone.com/reports/1154542;
    classtype:trojan-activity;
    sid:2044201; rev:2;
    metadata:attack_target Client_and_Server, created_at 2023_02_14, cve CVE_2021_22205, deployment Perimeter, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_04_06;
)