Joomla Web Endpoint GET Requests Matching CVE-2023-23752 Exploitation Parameters

title: Joomla Web Endpoint GET Requests Matching CVE-2023-23752 Exploitation Parameters
id: 65419e64-a23a-4c8d-87ae-7a2722518382
status: test
description: This rule flags HTTP GET requests to Joomla API endpoints whose query string contains both '/api/index.php/v1/' and 'public=true'. Attackers often probe or attempt exploitation by targeting specific application routes and parameter combinations. The detection relies on webserver request telemetry capturing the HTTP method and full URI query content.
references:
  - https://xz.aliyun.com/t/12175
  - https://twitter.com/momika233/status/1626464189261942786
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-23752/web_cve_2023_23752_joomla_exploit_attempt.yml
author: Bhabesh Raj, Huntrule Team
date: 2023-02-23
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-23752
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: GET
    cs-uri-query|contains|all:
      - /api/index.php/v1/
      - public=true
  condition: selection
falsepositives:
  - Vulnerability scanners
level: high
license: DRL-1.1
related:
  - id: 0e1ebc5a-15d0-4bf6-8199-b2535397433a
    type: derived