YARA rules for CVE-2021-31166
1 rules · scoped to cve · back to CVE-2021-31166
YARA rules whose family, name, or description matches this cve or its tooling. Use these for binary-pattern hunts.
rule EXPL_CVE_2021_31166_Accept_Encoding_May21_1 {
meta:
description = "Detects malformed Accept-Encoding header field as used in code exploiting CVE-2021-31166"
author = "Florian Roth (Nextron Systems)"
reference = "https://github.com/0vercl0k/CVE-2021-31166"
date = "2021-05-21"
score = 70
id = "d0a79cdc-f3ee-58f9-805c-ec9eb7993315"
strings:
$xr1 = /[Aa]ccept\-[Ee]ncoding: [a-z\-]{1,16},([a-z\-\s]{1,16},|)*[\s]{1,20},/
condition:
1 of them
}