Webserver POST to VMware View Planner logupload endpoint with CVE-2021-21978 probes

title: Webserver POST to VMware View Planner logupload endpoint with CVE-2021-21978 probes
id: db849610-3d2c-46b6-b89f-ac5c98ccf745
status: test
description: This rule flags HTTP POST requests to a specific VMware View Planner log upload path by matching required query-string parameters and the wsgi_log_upload.py component. Attackers commonly use this type of request to attempt to trigger or exercise a known vulnerability during initial access. The detection relies on webserver telemetry capturing the HTTP method and the full requested URI query string.
references:
  - https://twitter.com/wugeej/status/1369476795255320580
  - https://paper.seebug.org/1495/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-21978/web_cve_2021_21978_vmware_view_planner_exploit.yml
author: Bhabesh Raj, Huntrule Team
date: 2020-03-10
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2021-21978
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains|all:
      - logupload
      - logMetaData
      - wsgi_log_upload.py
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 77586a7f-7ea4-4c41-b19c-820140b84ca9
    type: derived