14 lines
505 B
Text
14 lines
505 B
Text
|
|
rule EXPL_CVE_2021_31166_Accept_Encoding_May21_1 {
|
|
meta:
|
|
description = "Detects malformed Accept-Encoding header field as used in code exploiting CVE-2021-31166"
|
|
author = "Florian Roth (Nextron Systems)"
|
|
reference = "https://github.com/0vercl0k/CVE-2021-31166"
|
|
date = "2021-05-21"
|
|
score = 70
|
|
id = "d0a79cdc-f3ee-58f9-805c-ec9eb7993315"
|
|
strings:
|
|
$xr1 = /[Aa]ccept\-[Ee]ncoding: [a-z\-]{1,16},([a-z\-\s]{1,16},|)*[\s]{1,20},/
|
|
condition:
|
|
1 of them
|
|
}
|