Possible CentOS Web Panel 7 RCE Probe via POST /login/index.php

title: Possible CentOS Web Panel 7 RCE Probe via POST /login/index.php
id: 5e0ab481-2397-486b-a0a2-bc93151eff65
status: test
description: This rule flags HTTP POST requests to /login/index.php that include login= parameters containing patterns consistent with command execution attempts. It looks for shell-style syntax such as $(...), encoded “python” strings, and reverse-shell related indicators like base64, subprocess, socket, and ${IFS}. Such payloads can help attackers trigger unauthenticated remote code execution, so correlating these request patterns with webserver logs is critical to identify exploitation attempts. The detection relies on webserver request telemetry capturing HTTP method and the full URI query string.
references:
  - https://seclists.org/fulldisclosure/2023/Jan/1
  - https://www.rapid7.com/blog/post/2023/01/19/etr-exploitation-of-control-web-panel-cve-2022-44877/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-44877/web_cve_2022_44877_exploitation_attempt.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-20
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2022-44877
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains|all:
      - /login/index.php
      - login=
    cs-uri-query|contains:
      - login=$(
      - base64
      - subprocess
      - socket
      - ${IFS}
      - cHl0aG9u
      - B5dGhvb
      - weXRob2
  condition: selection
falsepositives:
  - Web vulnerability scanners
level: high
license: DRL-1.1
related:
  - id: 1b2eeb27-949b-4704-8bfa-d8e5cfa045a1
    type: derived