corelight/cve-2021-41773Zeekパッケージで、Apache HTTP Serverのパストラバーサル/RCEエクスプロイト（CVE-2021-41773、CVE-2021-42013）を検出し、ペイロードキャプチャとサーバーヘッダー分析によるインシデントレスポンスのトリアージを実現します。
Apache HTTP Server 2.4.49 (CVE-2021-41773) および 2.4.50 (CVE-2021-42013) のパストラバーサル/RCE に関する通知を発行する Zeek パッケージ
参照
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-42013
https://blog.sonatype.com/apache-servers-actively-exploited-in-wild-importance-of-prompt-patching
https://corelight.com/blog/tag/corelight-labs
zkg install https://github.com/corelight/CVE-2021-41773/
既存の pcap に対して使用する
zeek -Cr scripts/__load__.zeek your.pcap
このパッケージは、クラスタ環境および非クラスタ環境の両方で動作します。
PATH_TRAVERSAL_IS_VULNERABLE 通知の IR トリアージを支援するため、'sub' フィールドには以下のデータが含まれます:
global http_body_analysis_byte_depth: count = 1000;#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path notice
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] interval string string string double double
XXXXXXXXXX.XXXXXX CT7T802QofJINCquNg 127.0.0.1 44740 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/%2e%2e/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
XXXXXXXXXX.XXXXXX Cj7NfN13Javpjxe831 127.0.0.1 44744 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
XXXXXXXXXX.XXXXXX CIhB6g4tQcEI34f1Z7 127.0.0.1 44748 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%%32%65/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
XXXXXXXXXX.XXXXXX CMmr2q3Fe2wlSS2iUh 127.0.0.1 44752 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%%32%65/.%2e/%2e%2e/.%2e/%2e%2e/%2e%2e/.%%32%65/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
#close XXXX-XX-XX-XX-XX-XX