EXPL_JSP_CommVault_CVE_2025_57791_Aug25_1

rule EXPL_JSP_CommVault_CVE_2025_57791_Aug25_1 {
   meta:
      description = "Detects potential exploit for WT-2025-0049, Post-Auth RCE with QCommand Path Traversal"
      author = "X__Junior"
      date = "2025-08-21"
      reference = "https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"
      score = 75
      id = "6fdfa207-6361-5dfb-b313-623d7cfa95f1"
   strings:
      $s1 = "<App_GetUserPropertiesResponse>" ascii
      $s2 = "getMethod('getRuntime').invoke(null).exec(param.cmd)" ascii
   condition:
      filesize < 50KB and all of them
}