Proxy GET requests targeting /lang/log/httpd.log for CVE-2023-43261 disclosure

title: Proxy GET requests targeting /lang/log/httpd.log for CVE-2023-43261 disclosure
id: 674aa757-1a48-4b20-a864-f20b032a8c48
related:
  - id: a2bcca38-9f3a-4d5e-b603-0c587e8569d7
    type: similar
  - id: f48f5368-355c-4a1b-8bf5-11c13d589eaa
    type: derived
status: test
description: This rule flags proxy traffic where a GET request returns HTTP 200 while the requested URI contains /lang/log/httpd.log (including .old variants). Such behavior can indicate attempts to access sensitive router components through proxy logs in vulnerable Milesight UR5X/UR32L/UR32/UR35/UR41 devices prior to v35.3.0.7. Telemetry relies on proxy logs capturing HTTP method, requested URI, and response status codes.
references:
  - https://thehackernews.com/2023/10/experts-warn-of-severe-flaws-affecting.html
  - https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
  - https://github.com/win3zz/CVE-2023-43261
  - https://vulncheck.com/blog/real-world-cve-2023-43261
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-43261/proxy_exploit_cve_2023_43261_milesight_information_disclosure.yml
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule Team
date: 2023-10-20
modified: 2023-10-30
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-43621
  - detection.emerging-threats
logsource:
  category: proxy
detection:
  selection:
    cs-method: GET
    c-uri|contains: /lang/log/httpd.log
    sc-status: 200
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1