Webserver access logs indicate potential CVE-2023-43261 exploitation and information disclosure

title: Webserver access logs indicate potential CVE-2023-43261 exploitation and information disclosure
id: 4508c08f-f5a4-4f8f-a0b2-a7e0b4941b88
related:
  - id: f48f5368-355c-4a1b-8bf5-11c13d589eaa
    type: similar
  - id: a2bcca38-9f3a-4d5e-b603-0c587e8569d7
    type: derived
status: test
description: This rule flags HTTP GET requests that return status 200 and target the router access log path /lang/log/httpd.log (or .old) on Milesight UR5X/UR32L/UR32/UR35/UR41 devices. The behavior matters because it aligns with attempts to access sensitive router components via exposed log files, potentially disclosing internal information. It relies on webserver access log telemetry fields for HTTP method, requested URI stem, and response status codes.
references:
  - https://thehackernews.com/2023/10/experts-warn-of-severe-flaws-affecting.html
  - https://medium.com/@win3zz/inside-the-router-how-i-accessed-industrial-routers-and-reported-the-flaws-29c34213dfdf
  - https://github.com/win3zz/CVE-2023-43261
  - https://vulncheck.com/blog/real-world-cve-2023-43261
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-43261/web_exploit_cve_2023_43261_milesight_information_disclosure.yml
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo, Huntrule Team
date: 2023-10-20
modified: 2023-10-30
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2023-43621
  - detection.emerging-threats
logsource:
  category: webserver
  definition: "Requirements: In order for this detection to trigger, access logs of the router must be collected."
detection:
  selection:
    cs-method: GET
    cs-uri-stem|contains: /lang/log/httpd.log
    sc-status: 200
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1