CVE-2024-38475 Detection Scenario by crowdsecurity | CrowdSec Hub

CVE-2024-38475

Attack scenariohttp:exploitMITRE T1595MITRE T1190cve.CVE-2024-38475

By: crowdsecurity
Version: 0.1
Remediation: Ban

Detect CVE-2024-38475 exploitation attempts

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/CVE-2024-38475

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/CVE-2024-38475.yaml· 25 linesGitHub

1type: leaky1
2format: 2.0
3name: crowdsecurity/CVE-2024-38475
4description: "Detect CVE-2024-38475 exploitation attempts"
5filter: |2
6  evt.Meta.log_type in ['http_access-log', 'http_error-log'] && 
7  evt.Meta.http_status in ['404', '403'] &&
8  Lower(evt.Parsed.request) endsWith '%3f'
9groupby: "evt.Meta.source_ip"3
10distinct: "evt.Parsed.request"4
11capacity: 35
12blackhole: 2m6
13leakspeed: 10s7
14labels:
15  type: exploit
16  remediation: true8
17  classification:9
18    - attack.T1595
19    - attack.T1190
20    - cve.CVE-2024-38475
21  confidence: 3
22  spoofable: 0
23  behavior: "http:exploit"
24  label: "CVE-2024-38475"
25  service: apache

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect exploitation of apache CVE-2024-38475

Ref: https://blog.orange.tw/posts/2024-08-confusion-attacks-en/