Wazuh RCE exploitation attempt via traversal in /manager/files path parameter

title: Wazuh RCE exploitation attempt via traversal in /manager/files path parameter
id: 8ec015c7-4546-466d-a9b9-a207e7c517ed
status: test
description: This rule flags webserver requests whose query string contains a specific path traversal pattern targeting /manager/files with '../../../../..' sequences and an attempt to reach etc/lists. Such requests indicate an attacker may be probing for or exploiting a server-side file handling weakness. It relies on webserver telemetry that records HTTP query strings and searches for the exact substring match shown in the rule.
references:
  - https://github.com/WickdDavid/CVE-2021-26814/blob/6a17355a10ec4db771d0f112cbe031e418d829d5/PoC.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-26814/web_cve_2021_26814_wzuh_rce.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-05-22
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-21978
  - cve.2021-26814
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: /manager/files?path=etc/lists/../../../../..
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b9888738-29ed-4c54-96a4-f38c57b84bb3
    type: derived