Rule Document 1:65440

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP CrushFTP AS2 validation potential remote code execution attempt

Rule Explanation

This rule looks for a large number of requests to the /WebInterface/function endpoint of CrushFTP web applications that attempt to exploit a race condition in the application's handling of AS2-TO headers to bypass authentication and achieve remote code execution.

What To Look For

This rule alerts on attempts to exploit a remote code execution vulnerability in CrushFTP.

Known Usage

Attacks/Scans seen in the wild

False Positives

Known false positives, with the described conditions

This rule will drop any attempts to access the /WebInterface/function endpoint of CrushFTP using AS2 authentication.

Contributors

Cisco Talos Intelligence Group