Confluence Web Exploit Attempt via Path Traversal in POST /upload.action (CVE-2019-3398)

Alert on Confluence POST /upload.action requests with query-based path traversal filename patterns consistent with CVE-2019-3398.

FreeUnreviewedSigmacriticalv1

confluence-web-exploit-attempt-via-path-traversal-in-post-upload-action-cve-2019-e9bc39ae

title: Confluence Web Exploit Attempt via Path Traversal in POST /upload.action (CVE-2019-3398)
id: 5abb4ab1-d634-413e-bbc5-cdf0e7c4afe9
status: test
description: This rule flags HTTP POST requests to Confluence's /upload.action endpoint whose query string contains a path traversal filename pattern (filename=../../../../). Such requests are indicative of attempts to exploit CVE-2019-3398 for unauthorized file write behavior. It relies on webserver telemetry capturing the HTTP method and the full URI query string content for matching.
references:
  - https://devcentral.f5.com/s/articles/confluence-arbitrary-file-write-via-path-traversal-cve-2019-3398-34181
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Exploits/CVE-2019-3398/web_cve_2019_3398_confluence.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-05-26
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2019-3398
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains|all:
      - /upload.action
      - filename=../../../../
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: e9bc39ae-978a-4e49-91ab-5bd481fc668b
    type: derived

What it detects

This rule flags HTTP POST requests to Confluence's /upload.action endpoint whose query string contains a path traversal filename pattern (filename=../../../../). Such requests are indicative of attempts to exploit CVE-2019-3398 for unauthorized file write behavior. It relies on webserver telemetry capturing the HTTP method and the full URI query string content for matching.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.