SID 1:45109

Rule Category

SERVER-WEBAPP -- Snort has detected traffic exploiting vulnerabilities in web based applications on servers.

Alert Message

SERVER-WEBAPP OrientDB remote code execution attempt

Rule Explanation

Remote code execution attempt against OrientDB. Impact: Potential remote code execution Details: Looks for a groovy function being POST'd to the OrientDB server. Ease of Attack: Simple; PoC is publicly-available

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group