YARA rules

Home/CVE-2021-22205/YARA rules

YARA

YARA rules for CVE-2021-22205

1 rules · scoped to cve · back to CVE-2021-22205

YARA rules whose family, name, or description matches this cve or its tooling. Use these for binary-pattern hunts.

◈

1 of 1

direct GitLab

EXPL_GitLab_CE_RCE_CVE_2021_22205

Detects signs of exploitation of GitLab CE CVE-2021-22205

author Florian Roth (Nextron Systems) license see source repo

view YARA rule

rule EXPL_GitLab_CE_RCE_CVE_2021_22205 {
   meta:
      description = "Detects signs of exploitation of GitLab CE CVE-2021-22205"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://security.humanativaspa.it/gitlab-ce-cve-2021-22205-in-the-wild/"
      date = "2021-10-26"
      score = 70
      id = "21cc6fa7-e50d-5b8e-815d-27315ab5635d"
   strings:
      /* User.find_by(username */
      $sa1 = "VXNlci5maW5kX2J5KHVzZXJuYW1l" ascii
      $sa2 = "VzZXIuZmluZF9ieSh1c2VybmFtZ" ascii
      $sa3 = "Vc2VyLmZpbmRfYnkodXNlcm5hbW" ascii

      /* user.admin */
      $sb1 = "dXNlci5hZG1pb" ascii
      $sb2 = "VzZXIuYWRtaW" ascii
      $sb3 = "1c2VyLmFkbWlu" ascii

      /* user.save! */
      $sc1 = "dXNlci5zYXZlI" ascii
      $sc2 = "VzZXIuc2F2ZS" ascii
      $sc3 = "1c2VyLnNhdmUh" ascii
   condition:
      1 of ($sa*) and 1 of ($sb*) and 1 of ($sc*)
}

Showing 1-1 of 1

Prev 1 Next