Skip to content

Instantly share code, notes, and snippets.

@stamparm

stamparm/2017-5638.rules

Last active January 30, 2018 05:29
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save stamparm/a9cf56d40ac3ce5e48e36971946093f8 to your computer and use it in GitHub Desktop.
Save stamparm/a9cf56d40ac3ce5e48e36971946093f8 to your computer and use it in GitHub Desktop.
Download ZIP
Snort rule for Apache Struts Remote Code Execution (2017-5638)
Raw
2017-5638.rules
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"WEB_SERVER Apache Struts Remote Code Execution (2017-5638)"; flow:established,to_server; content:"opensymphony"; fast_pattern:only; content:"Content-Type|3a 20|"; http_header; pcre:"/Content-Type: [ ]*[%$]{[^\r\n]*#\w+/Hi"; reference:cve,2017-5638; classtype:web-application-attack; sid:9000101; rev:2;)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment