ET WEB_SPECIFIC_APPS Apache Flink Arbitrary File Read Attempt (CVE-2020-17519)

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS Apache Flink Arbitrary File Read Attempt (CVE-2020-17519)";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/jobmanager/logs/"; fast_pattern; startswith;
    http.uri.raw;
    pcre:"/^\/jobmanager\/logs\/\x2e\x2e%252f/";
    reference:cve,2020-17519;
    reference:url,attackerkb.com/topics/t2rkmB0Uem/cve-2020-17519/vuln-details;
    classtype:attempted-recon;
    sid:2053042; rev:1;
    metadata:affected_product Apache_Flink, attack_target Web_Server, tls_state plaintext, created_at 2024_05_30, cve CVE_2020_17519, deployment Perimeter, deployment Internal, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag CISA_KEV, updated_at 2024_05_30;
)