ET EXPLOIT Possible Oracle Opera RCE Attempt (CVE-2023-21932)

Query · suricata

flow:established;
http.method;
content:"POST";
http.uri;
content:"/Operajserv/webarchive/FileReceiver?filename="; fast_pattern; nocase; startswith;
pcre:"/^[a-zA-Z]\x3a\x5cMICROS\x5c/R";
content:"&jndiname="; distance:0;
content:"&username="; distance:0;
http.content_type;
content:"multipart/form-data|3b 20|boundary="; startswith;
http.header_names;
content:!"Referer|0d 0a|";
Raw source ET EXPLOIT Possible Oracle Opera RCE Attempt (CVE-2023-21932) · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET EXPLOIT Possible Oracle Opera RCE Attempt (CVE-2023-21932)";
    flow:established;
    http.method;
    content:"POST";
    http.uri;
    content:"/Operajserv/webarchive/FileReceiver?filename="; fast_pattern; nocase; startswith;
    pcre:"/^[a-zA-Z]\x3a\x5cMICROS\x5c/R";
    content:"&jndiname="; distance:0;
    content:"&username="; distance:0;
    http.content_type;
    content:"multipart/form-data|3b 20|boundary="; startswith;
    http.header_names;
    content:!"Referer|0d 0a|";
    reference:url,blog.assetnote.io/2023/04/30/rce-oracle-opera/;
    reference:cve,2023-21932;
    classtype:attempted-admin;
    sid:2045307; rev:1;
    metadata:attack_target Web_Server, created_at 2023_05_03, cve CVE_2023_21932, deployment Perimeter, performance_impact Low, confidence Low, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_05_03;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.