Cacti CVE-2022-46169 Detection Scenario by crowdsecurity | CrowdSec Hub

Cacti CVE-2022-46169

Attack scenariohttp:exploitMITRE T1592cve.CVE-2022-46169

By: crowdsecurity
Version: 0.3
Name: crowdsecurity/CVE-2022-46169
Remediation: Ban

Detect CVE-2022-46169 brute forcing

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/CVE-2022-46169

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/CVE-2022-46169.yaml· 46 linesGitHub

1type: leaky1
2name: crowdsecurity/CVE-2022-46169-bf
3description: "Detect CVE-2022-46169 brute forcing"
4filter: |2
5  Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') &&
6  Upper(evt.Parsed.verb) == 'GET' &&
7  Lower(evt.Parsed.http_args) contains 'host_id' &&
8  Lower(evt.Parsed.http_args) contains 'local_data_ids'
9leakspeed: "10s"3
10capacity: 54
11blackhole: 1m5
12groupby: "evt.Meta.source_ip"6
13labels:
14  type: exploit
15  remediation: true7
16  classification:8
17    - attack.T1592
18    - cve.CVE-2022-46169
19  spoofable: 0
20  confidence: 3
21  behavior: "http:exploit"
22  label: "Cacti CVE-2022-46169"
23  service: cacti
24---
25type: trigger1
26name: crowdsecurity/CVE-2022-46169-cmd
27description: "Detect CVE-2022-46169 cmd injection"
28filter: |2
29  Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') &&
30  Upper(evt.Parsed.verb) == 'GET' &&
31  Lower(evt.Parsed.http_args) contains 'action=polldata' &&
32  Lower(evt.Parsed.http_args) matches 'poller_id=.*(;|%3b)'
33blackhole: 1m5
34groupby: "evt.Meta.source_ip"6
35labels:
36  type: exploit
37  remediation: true7
38  classification:8
39    - attack.T1595
40    - attack.T1190

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

CVE-2022-46169

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data source was selected for any monitored device.