PHP Unit Test Framework CVE-2017-9841 Detection Scenario by crowdsecurity | CrowdSec Hub

PHP Unit Test Framework CVE-2017-9841

Attack scenariohttp:exploitMITRE T1595MITRE T1190cve.CVE-2017-9841

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/CVE-2017-9841
Remediation: Ban

Detect CVE-2017-9841 exploits

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/CVE-2017-9841

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/CVE-2017-9841.yaml· 21 linesGitHub

1type: trigger1
2#debug: true
3name: crowdsecurity/CVE-2017-9841
4description: "Detect CVE-2017-9841 exploits"
5filter: |2
6    evt.Meta.log_type == 'http_access-log' &&
7    Lower(evt.Meta.http_path) endsWith 'util/php/eval-stdin.php'
8blackhole: 1m3
9groupby: "evt.Meta.source_ip"4
10labels:
11  type: exploit
12  remediation: true5
13  classification:6
14    - attack.T1595
15    - attack.T1190
16    - cve.CVE-2017-9841
17  spoofable: 0
18  confidence: 3
19  behavior: "http:exploit"
20  label: "PHP Unit Test Framework CVE-2017-9841"
21  service: PHP

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

CVE-2017-9841

Detects exploit of CVE-2017-9841 vulnerability targeting PHP unit test framework.