Rule Document 1:67431

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Google Brotli decoder remote code execution attempt

Rule Explanation

This rule detects HTTP traffic that declares Brotli compression and contains a known malicious payload prefix in the message body. Successful exploitation can lead to remote code execution or denial of service on the targeted server.

What To Look For

This rule fires on attempts to exploit a Google Brotli decoder remote code execution vulnerability in web servers.

Known Usage

Attacks/Scans seen in the wild

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group