CVE-2020-10148 SolarWinds Orion API Auth Bypass

Description

Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts

Query · sigma

selection:
  cs-uri-query|contains:
  - /WebResource.axd
  - /ScriptResource.axd
  - /i18n.ashx
  - /Skipi18n
selection2:
  cs-uri-query|contains:
  - /SolarWinds/
  - /api/
valid_request_1:
  cs-uri-query|contains: Orion/Skipi18n/Profiler/
valid_request_2:
  cs-uri-query|contains:
  - css.i18n.ashx
  - js.i18n.ashx
condition: all of selection* and not 1 of valid_request_*

Known false positives

  • Unknown
Raw source CVE-2020-10148 SolarWinds Orion API Auth Bypass · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified. 
title: CVE-2020-10148 SolarWinds Orion API Auth Bypass
id: 5a35116f-43bc-4901-b62d-ef131f42a9af
status: test
description: Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts
references:
    - https://kb.cert.org/vuls/id/843464
author: Bhabesh Raj, Tim Shelton
date: 2020-12-27
modified: 2023-01-02
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2020-10148
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/WebResource.axd'
            - '/ScriptResource.axd'
            - '/i18n.ashx'
            - '/Skipi18n'
    selection2:
        cs-uri-query|contains:
            - '/SolarWinds/'
            - '/api/'
    valid_request_1:
        cs-uri-query|contains: 'Orion/Skipi18n/Profiler/'
    valid_request_2:
        cs-uri-query|contains:
            - 'css.i18n.ashx'
            - 'js.i18n.ashx'
    condition: all of selection* and not 1 of valid_request_*
falsepositives:
    - Unknown
level: critical

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.