ET WEB_SPECIFIC_APPS Raisecom MSG Series Gateway Command Injection Attempt (CVE-2024-7120)

alert http any any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS Raisecom MSG Series Gateway Command Injection Attempt (CVE-2024-7120)";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/vpn/list_base_config.php?"; fast_pattern; startswith;
    content:"type=mod";
    content:"parts=base_config";
    content:"template=";
    pcre:"/^.{0,20}(?:\x60|\x3b|%60|%3[Bb])/R";
    reference:url,github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7120.yaml;
    reference:cve,2024-7120;
    classtype:attempted-admin;
    sid:2056282; rev:1;
    metadata:affected_product Raisecom, attack_target Networking_Equipment, tls_state plaintext, created_at 2024_09_27, cve CVE_2024_7120, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_09_27;
    target:dest_ip;
)