Arcadyan router exploit attempts via web path traversal and unauthenticated config injection

title: Arcadyan router exploit attempts via web path traversal and unauthenticated config injection
id: 29b44751-b68c-428b-a27d-57294f0f4ecb
status: test
description: This rule flags HTTP requests whose query strings contain URL-encoded path traversal ('..%2f'), combined with conditions indicative of unauthenticated exploitation. It is designed to catch exploitation chains where attackers use traversal to bypass authentication and then target a specific CGI endpoint (apply_abstract.cgi) for configuration manipulation. It relies on webserver telemetry that records HTTP request paths and query parameters, specifically the presence and combination of these encoded strings.
references:
  - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
  - https://www.tenable.com/security/research/tra-2021-13
  - https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-20090/web_cve_2021_20090_2021_20091_arcadyan_router_exploit.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-08-24
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-20090
  - cve.2021-20091
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  path_traversal:
    cs-uri-query|contains: ..%2f
  config_file_inj:
    cs-uri-query|contains|all:
      - ..%2f
      - apply_abstract.cgi
  noauth_list:
    cs-uri-query|contains:
      - /images/
      - /js/
      - /css/
      - /setup_top_login.htm
      - /login.html
      - /loginerror.html
      - /loginexclude.html
      - /loginlock.html
  condition: (path_traversal or config_file_inj) and noauth_list
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: f0500377-bc70-425d-ac8c-e956cd906871
    type: derived