一个Zeek包，用于在Apache HTTP Server 2.4.49 (CVE-2021-41773)和2.4.50 (CVE-2021-42013)中检测路径遍历/远程代码执行并发出通知
参考资料
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-42013
https://blog.sonatype.com/apache-servers-actively-exploited-in-wild-importance-of-prompt-patching
https://corelight.com/blog/tag/corelight-labs
zkg install https://github.com/corelight/CVE-2021-41773/
对已有的pcap文件使用
zeek -Cr scripts/__load__.zeek your.pcap
此包可在集群或非集群环境中运行。
为了协助对PATH_TRAVERSAL_IS_VULNERABLE通知进行安全事件响应（IR）分类，'sub'字段将包含以下数据：
global http_body_analysis_byte_depth: count = 1000;#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path notice
#open XXXX-XX-XX-XX-XX-XX
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] interval string string string double double
XXXXXXXXXX.XXXXXX CT7T802QofJINCquNg 127.0.0.1 44740 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/%2e%2e/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
XXXXXXXXXX.XXXXXX Cj7NfN13Javpjxe831 127.0.0.1 44744 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
XXXXXXXXXX.XXXXXX CIhB6g4tQcEI34f1Z7 127.0.0.1 44748 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%%32%65/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
XXXXXXXXXX.XXXXXX CMmr2q3Fe2wlSS2iUh 127.0.0.1 44752 127.0.0.1 8000 - - - tcp CVE_2021_41773::PATH_TRAVERSAL_IS_VULNERABLE Possible Apache 2.4.49 or 2.4.50 path traversal exploit CVE-2021-41773. Refer to https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-41773. Refer to sub field for sample of payload, original_URI and list of server headers payload sample (first 1000 bytes of POST)='echo Content-Type: text/plain; echo; id', original_URI='/cgi-bin/.%%32%65/.%2e/%2e%2e/.%2e/%2e%2e/%2e%2e/.%%32%65/bin/sh', Server header value='Apache/2.4.49 (Unix)' 127.0.0.1 127.0.0.1 8000 - - Notice::ACTION_LOG 360XXXXXXXXXX.XXXXXX - - - - -
#close XXXX-XX-XX-XX-XX-XX