Sid 1-49304

Rule Documentation
References

Rule Category

SERVER-OTHER -- Snort has detected traffic exploiting vulnerabilities in a server in the network.

Alert Message

SERVER-OTHER Google Golang GET command injection attempt

Rule Explanation

This event is generated when Google Golang GET command injection attempted. Impact: Attempted User Privilege Gain Details: Ease of Attack:

What To Look For

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic:

Technique:

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

CVE-2018-7187

Rule Vulnerability

CVE Additional Information

CVE-2018-7187

The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.

Details
Severity		Base Score	8.8
Impact Score	5.9	Exploit Score	2.8
Confidentiality Impact	HIGH	Integrity Impact	HIGH
Availability Impact	HIGH	Access Vector
Authentication		Ease of Access