EXPL_GitLab_CE_RCE_CVE_2021_22205

rule EXPL_GitLab_CE_RCE_CVE_2021_22205 {
   meta:
      description = "Detects signs of exploitation of GitLab CE CVE-2021-22205"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/"
      date = "2021-10-26"
      score = 70
      id = "21cc6fa7-e50d-5b8e-815d-27315ab5635d"
   strings:
      /* User.find_by(username */
      $sa1 = "VXNlci5maW5kX2J5KHVzZXJuYW1l" ascii
      $sa2 = "VzZXIuZmluZF9ieSh1c2VybmFtZ" ascii
      $sa3 = "Vc2VyLmZpbmRfYnkodXNlcm5hbW" ascii

      /* user.admin */
      $sb1 = "dXNlci5hZG1pb" ascii
      $sb2 = "VzZXIuYWRtaW" ascii
      $sb3 = "1c2VyLmFkbWlu" ascii

      /* user.save! */
      $sc1 = "dXNlci5zYXZlI" ascii
      $sc2 = "VzZXIuc2F2ZS" ascii
      $sc3 = "1c2VyLnNhdmUh" ascii
   condition:
      1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*)
}