title: Potential Information Disclosure CVE-2023-43261 Exploitation - Proxy
id: f48f5368-355c-4a1b-8bf5-11c13d589eaa
related:
- id: a2bcca38-9f3a-4d5e-b603-0c587e8569d7
type: similar
status: test
description: |
Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in proxy logs.
references:
- https://thehackernews.com/2023/10/experts-warn-of-severe-flaws-affecting.html
- https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
- https://github.com/win3zz/CVE-2023-43261
- https://vulncheck.com/blog/real-world-cve-2023-43261
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
date: 2023-10-20
modified: 2023-10-30
tags:
- attack.initial-access
- attack.t1190
- cve.2023-43621
- detection.emerging-threats
logsource:
category: proxy
detection:
selection:
cs-method: 'GET'
# Note: In theory the path can also be for other files. But since the logs can contains password and interesting information. Its most likely going to be targeted during a real attack
c-uri|contains: '/lang/log/httpd.log' # Als covered .old
sc-status: 200
condition: selection
falsepositives:
- Unknown
level: high