Progress Kemp LoadMaster Unauthenticated Command Injection Exploitation via /access/set GET

Alerts on suspicious LoadMaster /access/set GET requests with enableapi/value=1 and anomalous Basic Authorization header content.

FreeUnreviewedSigmahighv1

progress-kemp-loadmaster-unauthenticated-command-injection-exploitation-via-acce-eafb8bd5

title: Progress Kemp LoadMaster Unauthenticated Command Injection Exploitation via /access/set GET
id: 52ef1b2c-7fe1-45d3-88bf-d63c09dc86c3
status: test
description: This rule flags likely exploitation attempts of an unauthenticated command injection against Progress Kemp LoadMaster by matching specific HTTP GET requests to /access/set. It looks for the query parameters param=enableapi and value=1 combined with an Authorization header whose base64-encoded value contains unusual characters. This behavior matters because attackers can trigger unauthorized API actions through crafted requests, and the rule relies on webserver HTTP request telemetry including method, URI path, query string, and Authorization header contents.
references:
  - https://github.com/RhinoSecurityLabs/CVEs/blob/15cf4d86c83daa57b59eaa2542a0ed47ad3dc32d/CVE-2024-1212/CVE-2024-1212.py
  - https://rhinosecuritylabs.com/research/cve-2024-1212unauthenticated-command-injection-in-progress-kemp-loadmaster/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1212/web_exploit_cve_2024_1212_.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-03-20
tags:
  - attack.initial-access
  - cve.2024-1212
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_path:
    cs-method: GET
    cs-uri-stem|contains|all:
      - /access/set
      - param=enableapi
      - value=1
  selection_keywords:
    - Basic Jz
    - Basic c7
    - Basic nO
    - Basic ';
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: eafb8bd5-7605-4bfe-a9ec-0442bc151f15
    type: derived

What it detects

This rule flags likely exploitation attempts of an unauthenticated command injection against Progress Kemp LoadMaster by matching specific HTTP GET requests to /access/set. It looks for the query parameters param=enableapi and value=1 combined with an Authorization header whose base64-encoded value contains unusual characters. This behavior matters because attackers can trigger unauthorized API actions through crafted requests, and the rule relies on webserver HTTP request telemetry including method, URI path, query string, and Authorization header contents.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.