Rule Document 1:67438

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP Adobe Commerce template directive injection attempt

Rule Explanation

This rule looks for GraphQL requests to the /graphql endpoint that invoke the setBillingAddressOnCart operation and contain embedded template directives such as {{if}} and {{block}} with a class attribute. Successful exploitation could allow an attacker to inject malicious directives that execute arbitrary code on the server.

What To Look For

This rule fires on attempts to exploit a template directive injection vulnerability in Adobe Commerce web applications.

Known Usage

Attacks/Scans seen in the wild

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group