SID 1:44790

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP MikroTik RouterOS cross site request forgery attempt

Rule Explanation

This event is generated when an attacker attempts a CSRF attack against MikroTik's RouterOS web-application. Impact: Web application attack Details: Rule looks for an malicious incoming HTML file that contains a request to MikroTik's RouterOS web-application in an attempt to change the admin password. Ease of Attack: Simple; PoC is publicly-available

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group