ZCS CVE-2022-37042 Detection Scenario by crowdsecurity | CrowdSec Hub

ZCS CVE-2022-37042

Attack scenariohttp:exploitMITRE T1595MITRE T1190cve.CVE-2022-37042

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/CVE-2022-37042
Remediation: Ban

Detect CVE-2022-37042 exploits

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/CVE-2022-37042

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/CVE-2022-37042.yaml· 26 linesGitHub

1type: trigger1
2#debug: true
3name: crowdsecurity/CVE-2022-37042
4description: "Detect CVE-2022-37042 exploits"
5filter: |2
6  (
7  Upper(evt.Meta.http_path) contains Upper('/service/extension/backup/mboximport?account-name=admin&ow=2&no-switch=1&append=1') ||
8  Upper(evt.Meta.http_path) contains Upper('/service/extension/backup/mboximport?account-name=admin&account-status=1&ow=cmd') 
9  )
10  and evt.Meta.http_status startsWith ('40') and
11  Upper(evt.Meta.http_verb) == 'POST'
12
13blackhole: 2m3
14groupby: "evt.Meta.source_ip"4
15labels:
16  type: exploit
17  remediation: true5
18  classification:6
19    - attack.T1595
20    - attack.T1190
21    - cve.CVE-2022-37042
22  spoofable: 0
23  confidence: 3
24  behavior: "http:exploit"
25  label: "ZCS CVE-2022-37042"
26  service: zimbra

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

CVE-2022-37042

Detects attempts of exploit of CVE-2022-37042 RCE vulnerability.