Ruckus Wireless Admin HTTP GET Injection Attempt Likely Targeting CVE-2023-25717

title: Ruckus Wireless Admin HTTP GET Injection Attempt Likely Targeting CVE-2023-25717
id: 23b2aeba-c1e0-4f34-a25f-3cbd1dd84c8d
status: test
description: This rule flags HTTP requests to Ruckus Wireless Admin login-related paths where the query parameters include command substitution patterns such as '$(' or its URL-encoded form '%24%28'. Such payloads are commonly used to test or trigger remote code execution behaviors without authentication. It relies on webserver telemetry capturing HTTP method and the full URI query string content, specifically matching GET requests that contain the expected login parameters plus the injection markers.
references:
  - https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-25717/web_cve_2023_25717_ruckus_wireless_admin_exploit_attempt.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-30
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-25717
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: GET
    cs-uri-query|contains|all:
      - /forms/doLogin
      - login_username
      - password
    cs-uri-query|contains:
      - $(
      - "%24%28"
  condition: selection
falsepositives:
  - Vulnerability scanners
  - Some rare false positives may occur if the password contains the characters "$(". Apply addition indicators such as executed commands to remove FP
level: high
license: DRL-1.1
related:
  - id: 043c1609-0e32-4462-a6f2-5a0c2da3fafe
    type: derived