Elastic medium deprecated eql

Deprecated - Potential curl CVE-2023-38545 Exploitation

Detects potential exploitation of curl CVE-2023-38545 by monitoring for vulnerable command line arguments in conjunction with an unusual command line length. A flaw in curl version <= 8.3 makes curl vulnerable to a heap based buffer overflow during the SOCKS5 proxy handshake. Upgrade to curl version >= 8.4 to patch this vulnerability. This exploit can be executed with and without the use of environment variables. For increased visibility, enable the collection of http_proxy, HTTPS_PROXY and ALL_PROXY environment variables based on the instructions provided in the setup guide of this rule.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and process.name == "curl"
and (
  process.args like ("--socks5-hostname", "--proxy", "--preproxy", "socks5*") or
  process.env_vars like ("http_proxy=socks5h://*", "HTTPS_PROXY=socks5h://*", "ALL_PROXY=socks5h://*")
) and length(process.command_line) > 255 and not (
  process.parent.name in ("cf-agent", "agent-run", "agent-check", "rudder", "agent-inventory", "cf-execd") or
  process.args like "/opt/rudder/*" or
  process.parent.executable like ("/vz/root/*", "/var/rudder/*")
)

Field Validations

Loading…

Comments (0)

Loading comments...