ET WEB_SPECIFIC_APPS WordPress Plugin wp-automatic Server-Side Request Forgery (CVE-2024-27954)

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET WEB_SPECIFIC_APPS WordPress Plugin wp-automatic Server-Side Request Forgery (CVE-2024-27954)";
    flow:established,to_server;
    http.uri;
    content:"/wp-content/plugins/wp-automatic/"; fast_pattern;
    http.request_body;
    content:"q|3d|";
    pcre:"/^(?:(?:S(?:HOW\x20(?:C(?:UR(?:DAT|TIM)E|HARACTER\x20SET)|(?:VARI|T)ABLES)|ELECT\x20(?:FROM|USER))|U(?:NION\x20SELEC|PDATE\x20SE)T|DELETE\x20FROM|INSERT\x20INTO)|S(?:HOW.+(?:C(?:HARACTER.+SET|UR(DATE|TIME))|(?:VARI|T)ABLES)|ELECT.+(?:FROM|USER))|U(?:NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\x2f\*.+\*\x2f)/Ri";
    reference:url,github.com/gh-ost00/CVE-2024-27954;
    reference:cve,2024-27954;
    classtype:web-application-attack;
    sid:2061306; rev:1;
    metadata:affected_product Wordpress_Plugins, attack_target Server, created_at 2025_04_04, cve CVE_2024_27954, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2025_04_04, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
    target:dest_ip;
)