Emerging Threathightest

Potential CVE-2023-25157 Exploitation Attempt

Detects a potential exploitation attempt of CVE-2023-25157 a SQL injection in GeoServer

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Wed Jun 14c0341543-5ed0-4475-aabc-7eea8c52aa662023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

Web Server Log

CategoryWeb Server Log← raw: webserver

HTTP access logs from web servers capturing request paths, methods, and status codes.

Detection Logic

detection:
    selection_url:
        cs-method: 'GET'
        cs-uri-query|contains|all:
            - '/geoserver/ows'
            - 'CQL_FILTER='
        cs-uri-query|contains:
            # Abusable Filters/Function as reported in the Advisory
            - 'PropertyIsLike'
            - 'strEndsWith'
            - 'strStartsWith'
            - 'FeatureId'
            - 'jsonArrayContains'
            - 'DWithin'
    selection_payload:
        cs-uri-query|contains:
            - '+--'
            - '+AS+'
            - '+OR+'
            - 'FROM'
            - 'ORDER+BY'
            - 'SELECT'
            - 'sleep%28'
            - 'substring%28'
            - 'UNION'
            - 'WHERE'
    condition: all of selection_*