Potential Unauthenticated Command Injection Attempts via TP-Link Archer AX21 CGI Paths

title: Potential Unauthenticated Command Injection Attempts via TP-Link Archer AX21 CGI Paths
id: 5fd23f28-c88a-495a-9fbd-74d2ba27fc5f
status: test
description: This rule flags web requests to TP-Link Archer AX21 endpoints consistent with an unauthenticated command injection attempt targeting a CGI-based URL that includes locale handling. An attacker could leverage this type of payload delivery to execute commands without valid session context. The detection relies on proxy telemetry observing HTTP methods (GET/POST) and matching the request URI and query parameters associated with country form writes and command substitution patterns.
references:
  - https://www.tenable.com/security/research/tra-2023-11
  - https://github.com/Voyag3r-Security/CVE-2023-1389/blob/4ecada7335b17bf543c0e33b2c9fb6b6215c09ae/archer-rev-shell.py
  - https://www.zerodayinitiative.com/blog/2023/4/21/tp-link-wan-side-vulnerability-cve-2023-1389-added-to-the-mirai-botnet-arsenal
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-1389/proxy_exploit_cve_2023_1389_unauth_command_injection_tplink_archer_ax21.yml
author: Nasreddine Bencherchali (Nextron Systems), Rohit Jain, Huntrule Team
date: 2024-06-25
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-1389
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection_uri:
    cs-method:
      - GET
      - POST
    cs-uri|contains|all:
      - /cgi-bin/luci/;stok=/locale
      - form=country
  selection_keyword:
    - operation=write
    - country=$(
  condition: all of selection_*
falsepositives:
  - Vulnerability Scanners
level: medium
license: DRL-1.1
related:
  - id: 6c7defa9-69f8-4c34-b815-41fce3931754
    type: derived