Skip to content

Instantly share code, notes, and snippets.

@fox-srt

fox-srt/cve-2022-36537.rules

Created February 21, 2023 12:55
Show Gist options
  • Save fox-srt/dc299b5e16061e19d061f490f51b6a4a to your computer and use it in GitHub Desktop.
Save fox-srt/dc299b5e16061e19d061f490f51b6a4a to your computer and use it in GitHub Desktop.
Download ZIP
Snort & Suricata signatures for CVE-2022-36537, ZK Java Framework authentication bypass
Raw
cve-2022-36537.rules
# Detection for the exploitation of CVE-2022-36537 (ZK Java Framework)
alert tcp any any -> any any (msg:"FOX-SRT - Flowbit - CVE-2022-36537 Exploitation Attempt Observed"; flow:established, to_server; content:"POST"; http_method; content:"/zkau/upload"; http_uri; fast_pattern; content:"uuid="; http_uri; content:"sid="; http_uri; content:"dtid="; http_uri; content:"nextURI="; flowbits:set, fox.cve.2022-36537; threshold:type limit, track by_src, count 1, seconds 3600; classtype:web-application-attack; metadata:CVE 2022-36537; metadata:created_at 2023-01-13; priority:3; sid:21004354; rev:1;)
alert tcp any any -> any any (msg:"FOX-SRT - Exploit - CVE-2022-36537 Possible Successful Exploitation Observed"; flow:established, from_server; flowbits:isset, fox.cve.2022-36537; content:"200"; http_stat_code; content:!"<title>Upload Result</title>"; threshold:type limit, track by_dst, count 1, seconds 3600; classtype:web-application-attack; metadata:CVE 2022-36537; metadata:created_at 2023-01-13; priority:1; sid:21004355; rev:1;)
@fox-srt
Copy link
Author

fox-srt commented Feb 22, 2023

Blog post: https://blog.fox-it.com/2023/02/22/from-backup-to-backdoor-exploitation-of-cve-2022-36537-in-r1soft-server-backup-manager/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment