ET WEB_SPECIFIC_APPS Possible Skype for Business SSRF Attempt (CVE-2023-41763)

alert http $HTTP_SERVERS any -> any any (
    msg:"ET WEB_SPECIFIC_APPS Possible Skype for Business SSRF Attempt (CVE-2023-41763)";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.accept;
    content:"Application/vnd.microsoft.lync.meeting+xml";
    http.user_agent;
    content:"LCS-Server"; fast_pattern;
    reference:url,frycos.github.io/vulns4free/2022/09/26/skype-audit-part2.html;
    reference:cve,2023-41763;
    classtype:web-application-attack;
    sid:2048538; rev:1;
    metadata:affected_product Skype_For_Business, attack_target Web_Server, created_at 2023_10_11, cve CVE_2023_41763, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence Low, signature_severity Minor, tag CISA_KEV, updated_at 2023_10_11, reviewed_at 2024_10_02;
)