detection.wiki

Detection rules › Sigma

Potential Information Disclosure CVE-2023-43261 Exploitation - Web

Status
test
Severity
high
Log source
category webserver
Author
Nasreddine Bencherchali (Nextron Systems), Thurein Oo
Source
github.com/SigmaHQ/sigma

Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in access logs.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1190 Exploit Public-Facing Application

Rule body yaml

title: Potential Information Disclosure CVE-2023-43261 Exploitation - Web
id: a2bcca38-9f3a-4d5e-b603-0c587e8569d7
related:
    - id: f48f5368-355c-4a1b-8bf5-11c13d589eaa
      type: similar
status: test
description: |
    Detects exploitation attempts of CVE-2023-43261 and information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 that allows attackers to access sensitive router components in access logs.
references:
    - https://thehackernews.com/2023/10/experts-warn-of-severe-flaws-affecting.html
    - https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
    - https://github.com/win3zz/CVE-2023-43261
    - https://vulncheck.com/blog/real-world-cve-2023-43261
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
date: 2023-10-20
modified: 2023-10-30
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2023-43621
    - detection.emerging-threats
logsource:
    category: webserver
    definition: 'Requirements: In order for this detection to trigger, access logs of the router must be collected.'
detection:
    selection:
        cs-method: 'GET'
        # Note: In theory the path can also be for other files. But since the logs can contains password and interesting information. Its most likely going to be targeted during a real attack
        cs-uri-stem|contains: '/lang/log/httpd.log' # Als covered .old
        sc-status: 200
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    cs-method: 'GET'
    cs-uri-stem|contains: '/lang/log/httpd.log'
    sc-status: 200

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
cs-methodeq
  • GET
cs-uri-stemmatch
  • /lang/log/httpd.log
sc-statuseq
  • 200