Potential CVE-2023-27997 Exploitation Indicators

Status: test
Severity: medium
Log source: category webserver
Author: Sergio Palacios Dominguez, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects indicators of potential exploitation of CVE-2023-27997 in Frotigate weblogs. To avoid false positives it is best to look for successive requests to the endpoints mentioned as well as weird values of the "enc" parameter

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

title: Potential CVE-2023-27997 Exploitation Indicators
id: 31e4e649-7394-4fd2-9ae7-dbc61eebb550
status: test
description: |
    Detects indicators of potential exploitation of CVE-2023-27997 in Frotigate weblogs.
    To avoid false positives it is best to look for successive requests to the endpoints mentioned as well as weird values of the "enc" parameter
references:
    - https://blog.lexfo.fr/Forensics-xortigate-notice.html
    - https://blog.lexfo.fr/xortigate-cve-2023-27997.html
    - https://research.kudelskisecurity.com/2023/06/12/cve-2023-27997-fortigate-ssl-vpn/
    - https://labs.watchtowr.com/xortigate-or-cve-2023-27997/
author: Sergio Palacios Dominguez, Nasreddine Bencherchali (Nextron Systems)
date: 2023-07-28
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2023-27997
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection_uri:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - '/remote/hostcheck_validate'
            - '/remote/logincheck'
    selection_keywords:
        - 'enc='
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_uri`

selection_uri:
    cs-method:
        - 'GET'
        - 'POST'
    cs-uri-query|contains:
        - '/remote/hostcheck_validate'
        - '/remote/logincheck'

Stage 2: `selection_keywords`

selection_keywords:
    - 'enc='

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cs-method`	eq	`GET` `POST`	`field:"cs-method" kind:eq`
`cs-uri-query`	match	`/remote/hostcheck_validate` `/remote/logincheck`	`field:"cs-uri-query" kind:match`