Webserver: Potential CVE-2023-25717 Ruckus Wireless Admin Injection via Unauthenticated HTTP GET

title: "Webserver: Potential CVE-2023-25717 Ruckus Wireless Admin Injection via Unauthenticated HTTP GET"
id: 23b2aeba-c1e0-4f34-a25f-3cbd1dd84c8d
status: test
description: This rule flags unauthenticated HTTP GET requests to Ruckus Wireless Admin login-related endpoints that include credential fields and embedded shell/substitution patterns. The matching query parameters suggest an attempt to inject or execute code through crafted input, consistent with exploitation attempts. It relies on webserver telemetry capturing HTTP method and full query strings, including URL-encoded characters.
references:
  - https://cybir.com/2023/cve/proof-of-concept-ruckus-wireless-admin-10-4-unauthenticated-remote-code-execution-csrf-ssrf/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-25717/web_cve_2023_25717_ruckus_wireless_admin_exploit_attempt.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-30
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-25717
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: GET
    cs-uri-query|contains|all:
      - /forms/doLogin
      - login_username
      - password
    cs-uri-query|contains:
      - $(
      - "%24%28"
  condition: selection
falsepositives:
  - Vulnerability scanners
  - Some rare false positives may occur if the password contains the characters "$(". Apply addition indicators such as executed commands to remove FP
level: high
license: DRL-1.1
related:
  - id: 043c1609-0e32-4462-a6f2-5a0c2da3fafe
    type: derived