Update Details

Update #3154 (03/19/2019)

6 new signatures:

MEDIUM	HTTP:PHP:JOOMLA-SIMPLEFILEUPLD	HTTP: Joomla mod simplefileupload Arbitrary File Upload
HIGH	HTTP:BIT-COIN-MINING	HTTP: Bit-Coin Cryptocurrency Mining
MEDIUM	HTTP:DIR:MADDASH-WEB	HTTP: MaDDash Multiple Directory Listing Vulnerabilities
HIGH	HTTP:MISC:DOCKER-API-CE	HTTP:Docker API Remote Code Execution
MEDIUM	HTTP:INFO-LEAK:DLINK-DIR-601-ID	HTTP: D-link DIR-601 CVE-2018-5708 Information Disclosure
HIGH	HTTP:PHP:PRESTA-PSMOD	HTTP: Prestashop psmodthemeoptionpanel Arbitrary File Upload

1 renamed signature:

HTTP:DIR:MADDASH-WEB-DIR

HTTP:DIR:MADDASH-WEB

Details of the signatures included within this bulletin:

HTTP:PHP:JOOMLA-SIMPLEFILEUPLD - HTTP: Joomla mod simplefileupload Arbitrary File Upload

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against Joomla module named simplefileupload version prior to 1.3.5. A remote attacker can upload arbitrary files.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, isg-3.0.0, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, srx-17.4, idp-5.1.110170603, vsrx-15.1

HTTP:DIR:MADDASH-WEB - HTTP: MaDDash Multiple Directory Listing Vulnerabilities

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against MadDash webui. A successful attack can lead to Directory Traversal.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, isg-3.0.0, idp-5.1.110170603, vsrx-15.1

References:

Affected Products:

Perfsonar monitoring_and_debugging_dashboard 2.0.2

HTTP:MISC:DOCKER-API-CE - HTTP:Docker API Remote Code Execution

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Docker API. A remote attacker can execute arbitrary commands using create endpoint.

Supported On:

HTTP:INFO-LEAK:DLINK-DIR-601-ID - HTTP: D-link DIR-601 CVE-2018-5708 Information Disclosure

Severity: MEDIUM

Description:

This signature detects attempts to exploit a known vulnerability against D-link DIR-601. A successful attack can lead to Information Disclosure.

Supported On:

References:

cve: CVE-2018-5708

Affected Products:

Dlink dir-601_firmware 2.02na

HTTP:BIT-COIN-MINING - HTTP: Bit-Coin Cryptocurrency Mining

Severity: HIGH

Description:

This signature detects the Stratum protocol. Stratum is a protocol that is used by cryptocurrency mining software to contribute to a mining pool. Bitcoin is an example of an online cryptocurrency.

Supported On:

idp-5.1.110161014, idp-4.0.0, idp-4.0.110090709, idp-4.0.110090831, idp-4.1.0, mx-16.1, idp-4.2.0, srx-17.3, vmx-17.4, isg-3.5.141818, vsrx-17.4, srx-branch-17.4, srx-17.4, isg-3.1.134269, isg-3.1.135801, isg-3.4.0, vsrx3bsd-18.2, isg-3.5.0, srx-19.1, vsrx3bsd-19.1, vsrx-19.1, j-series-9.5, vsrx-19.2, srx-19.2, srx-branch-19.2, idp-4.2.110100823, idp-4.2.110101203, idp-5.1.0, srx-branch-19.1, idp-4.1.110110609, idp-4.1.110110719, mx-11.4, vsrx3bsd-19.2, idp-5.0.0, srx-18.2, isg-3.4.139899, idp-5.0.110121210, srx-12.1, srx-branch-12.1, isg-3.4.140032, idp-5.0.110130325, vsrx-12.1, idp-5.1.110170603, vsrx-15.1

HTTP:PHP:PRESTA-PSMOD - HTTP: Prestashop psmodthemeoptionpanel Arbitrary File Upload

Severity: HIGH

Description:

This signature detects attempts to exploit a known vulnerability against Prestashop module psmodthemeoptionpanel. A remote unauthenticated attacker can upload arbitrary file in server.

Supported On:

References:

url: https://github.com/Moham3dRiahi/XAttacker