Centos Webpanel CVE-2022-44877 Detection Scenario by crowdsecurity | CrowdSec Hub

Centos Webpanel CVE-2022-44877

Attack scenariohttp:exploitMITRE T1595MITRE T1190cve.CVE-2022-44877

By: crowdsecurity
Version: 0.4
Name: crowdsecurity/CVE-2022-44877
Remediation: Ban

Detect CVE-2022-44877 exploits

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/CVE-2022-44877

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/CVE-2022-44877.yaml· 24 linesGitHub

1type: trigger1
2#debug: true
3name: crowdsecurity/CVE-2022-44877
4description: "Detect CVE-2022-44877 exploits"
5filter: |2
6  Lower(evt.Meta.http_path) contains '/index.php' &&
7  Upper(evt.Parsed.verb) == 'POST' &&
8  evt.Meta.http_status == '302' &&
9  Lower(evt.Parsed.http_args) matches 'login=.*(\\$|%24)(\\(|%28).*(\\)|%29)'
10
11blackhole: 1m3
12groupby: "evt.Meta.source_ip"4
13labels:
14  type: exploit
15  remediation: true5
16  classification:6
17    - attack.T1595
18    - attack.T1190
19    - cve.CVE-2022-44877
20  spoofable: 0
21  confidence: 3
22  behavior: "http:exploit"
23  label: "Centos Webpanel CVE-2022-44877"
24  service: centos

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

CVE-2022-44877

Trigger exploits of CVE-2022-44877 Centos Web Panel 7 Unauthenticated Remote Code Execution

Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-44877