Command injection vulnerability triggered

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect successful exploits of the command injection vulnerability.

Strategy

Run a heuristic in the library (rule rasp-932-100) to monitor shell command execution.
When the command executed appears to be controlled by the user (and that the control doesn’t appear legitimate), those specific commands are highlighted.
Since the exploit is proven and the attacker may be taking over the underlying infrastructure, the severity of the signal is set to CRITICAL.

Triage and response

  1. Consider blocking the attacking IPs temporarily to slow down the further exploitation of your infrastructure.
  2. Consider switching the WAF rule rasp-932-100 to blocking mode to prevent exploitation.
  3. Leverage traces to determine the vulnerable codepath, and fix the code.