Date: 08/28/2024
Severity: Medium
Summary
Detects potential exploitation attempts of CVE-2023-1389, an unauthenticated command injection vulnerability in the TP-Link Archer AX21.
Indicators of Compromise (IOC) List
cs-method | 'GET' 'POST' |
cs-uri | '/cgi-bin/luci/;stok=/locale' 'form=country' 'operation=write' 'country=$(' |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 | (resourceName = "BlueCoat ProxyClient" AND proxycsmethod in ("GET","POST" ) ) AND proxycsuripath In ("/cgi-bin/luci/;stok=/locale" , "form=country" , "operation=write" , "country=$(") |
Detection Query 2 | (Technologygroup = "EDR" AND proxycsmethod in ("GET","POST" ) ) AND proxycsuripath In ("/cgi-bin/luci/;stok=/locale" , "form=country" , "operation=write" , "country=$(") |
Reference:
Sigma Detection Rule for TP-Link Archer AX21 Command Injection CVE-2023-1389
Tenable Security Research on CVE-2023-1389
Voyag3r Security Exploit Script for CVE-2023-1389
Zero Day Initiative Analysis of CVE-2023-1389 in the Mirai Botnet