Ghost CVE-2022-41697
Attack scenariohttp:exploitMITRE T1589cve.CVE-2022-41697
- Version
- 0.2
- Name
- crowdsecurity/CVE-2022-41697
- Remediation
- Ban
Detect CVE-2022-41697 enumeration
Install with a top-level collection
16 collections include itsudo cscli collections install crowdsecurity/whmInstalls 18 parsers and 66 scenarios, via HTTP - CVE Detection.
View WHM →Installation
sudo cscli scenarios install crowdsecurity/CVE-2022-41697Then reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
type: leakyname: crowdsecurity/CVE-2022-41697description: "Detect CVE-2022-41697 enumeration"filter: |Upper(evt.Meta.http_path) contains Upper('/ghost/api/admin/session') &&Upper(evt.Parsed.verb) == 'POST' &&evt.Meta.http_status == '404'leakspeed: "10s"capacity: 5blackhole: 1mgroupby: "evt.Meta.source_ip"labels:type: exploitremediation: trueclassification:- attack.T1589- cve.CVE-2022-41697spoofable: 0confidence: 3behavior: "http:exploit"label: "Ghost CVE-2022-41697"service: ghost
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.