Text4Shell CVE-2022-42889 Detection Scenario by crowdsecurity | CrowdSec Hub

Text4Shell CVE-2022-42889

Attack scenariohttp:exploitMITRE T1595MITRE T1190cve.CVE-2022-42889

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/CVE-2022-42889
Remediation: Ban

Detect CVE-2022-42889 exploits (Text4Shell)

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/CVE-2022-42889

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/CVE-2022-42889.yaml· 26 linesGitHub

1type: trigger1
2#debug: true
3name: crowdsecurity/CVE-2022-42889
4description: "Detect CVE-2022-42889 exploits (Text4Shell)"
5filter: |2
6  Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${script:javascript:java.lang.Runtime.getRuntime().exec(')
7  or
8  Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${script:js:java.lang.Runtime.getRuntime().exec(')
9  or
10  Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${url:UTF-8:') 
11  or
12  Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${dns:address|')
13blackhole: 1m3
14groupby: "evt.Meta.source_ip"4
15labels:
16  type: exploit
17  remediation: true5
18  classification:6
19    - attack.T1595
20    - attack.T1190
21    - cve.CVE-2022-42889
22  spoofable: 0
23  confidence: 3
24  behavior: "http:exploit"
25  label: "Text4Shell CVE-2022-42889"
26  service: apache

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

CVE-2022-42889

Detects attempts of exploit of CVE-2022-42889 (Text4Shell) RCE vulnerability.

Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42889