EXPL_GitLab_CE_RCE_Malformed_JPG_CVE_2021_22204

rule EXPL_GitLab_CE_RCE_Malformed_JPG_CVE_2021_22204 {
   meta:
      description = "Detects malformed JPG files exploting EXIF vulnerability CVE-2021-22204 and used in the exploitation of GitLab vulnerability CVE-2021-22205"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=blog"
      date = "2021-10-26"
      score = 70
      id = "3d769340-0306-596d-8783-2b37b93a5673"
   strings:
      $h1 = { 41 54 26 54 46 4F 52 4D }
      $sr1 = /\(metadata[\s]{0,3}\([A-Za-z]{1,20} "\\/
   condition:
      filesize < 10KB 
      and $h1
      and $sr1
}