Progress Kemp LoadMaster Unauthenticated Command Injection via /access/set GET Parameters
Alerts on suspicious LoadMaster /access/set GET requests with enableapi/value=1 and anomalous Basic Authorization header content.
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-03-20
- Updated
- 2026-07-31
What it detects
This rule flags likely exploitation attempts against Progress Kemp LoadMaster by matching unauthenticated HTTP GET requests targeting the /access/set endpoint. It looks for specific query parameters (param=enableapi and value=1) combined with an Authorization header containing base64-encoded content that includes uncommon characters, which can indicate crafted payloads. Telemetry required includes webserver request method, requested URI stem, query string, and the Authorization header.
Reporting behind it
- github.comhttps://github.com/RhinoSecurityLabs/CVEs/blob/15cf4d86c83daa57b59eaa2542a0ed47ad3dc32d/CVE-2024-1212/CVE-2024-1212.py
- rhinosecuritylabs.comhttps://rhinosecuritylabs.com/research/cve-2024-1212unauthenticated-command-injection-in-progress-kemp-loadmaster/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1212/web_exploit_cve_2024_1212_.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Progress Kemp LoadMaster Unauthenticated Command Injection via /access/set GET Parameters
id: 52ef1b2c-7fe1-45d3-88bf-d63c09dc86c3
status: test
description: This rule flags likely exploitation attempts against Progress Kemp LoadMaster by matching unauthenticated HTTP GET requests targeting the /access/set endpoint. It looks for specific query parameters (param=enableapi and value=1) combined with an Authorization header containing base64-encoded content that includes uncommon characters, which can indicate crafted payloads. Telemetry required includes webserver request method, requested URI stem, query string, and the Authorization header.
references:
- https://github.com/RhinoSecurityLabs/CVEs/blob/15cf4d86c83daa57b59eaa2542a0ed47ad3dc32d/CVE-2024-1212/CVE-2024-1212.py
- https://rhinosecuritylabs.com/research/cve-2024-1212unauthenticated-command-injection-in-progress-kemp-loadmaster/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Exploits/CVE-2024-1212/web_exploit_cve_2024_1212_.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-03-20
tags:
- attack.initial-access
- cve.2024-1212
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_path:
cs-method: GET
cs-uri-stem|contains|all:
- /access/set
- param=enableapi
- value=1
selection_keywords:
- Basic Jz
- Basic c7
- Basic nO
- Basic ';
condition: all of selection_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: eafb8bd5-7605-4bfe-a9ec-0442bc151f15
type: derived