Rule Document 1:67154

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER Microsoft .NET FtpWebRequest CRLF injection attempt

Rule Explanation

This rule looks for a "RETR" command at the start of an FTP request and a second command appearing after a CRLF sequence within the same packet. Successful exploitation allows an attacker to bypass file permissions and gain elevated access on the FTP server.

What To Look For

This rule fires on attempts to exploit an escalation of privilege vulnerability in Microsoft .NET Framework FTP servers.

Known Usage

Public information/Proof of Concept available

False Positives

Known false positives, with the described conditions

This rule may alert on benign FTP requests containing RETR and DELE commands in the same packet.

Contributors

Cisco Talos Intelligence Group

Rule Groups

Rule Categories::Server::Other

MITRE::ATT&CK Framework::Enterprise::Privilege Escalation::Exploitation for Privilege Escalation

Privilege escalation includes techniques that allow an attacker to obtain a higher level of permissions on the mobile device. Attackers may enter the mobile device with very limited privileges and may be required to take advantage of a device weakness to obtain higher privileges necessary to successfully carry out their mission objectives.

Rule Categories::Protocol::FTP

Vulnerability::Severity::Critical

Vulnerability::Severity::High

Vendors + Products::Microsoft::.NET

Vendors + Products::Microsoft::Visual Studio

CVE

CVE-2023-36049

Additional Links

msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36049

Rule Vulnerability

Escalation of Privilege

An Escalation of Privilege (EOP) attack is any attack method that results in a user or application gaining permissions to access resources they normally would not have access to.

CVE Additional Information

This product uses data from the NVD API but is not endorsed or certified by the NVD.

CVE-2023-36049

Loading description