CVE-2019-0232.yaml

match:
  - ACTION_EXT_value: '(bat$)|(cmd$)'
generate:
  - into: URI
  - payload:
    - '?&set'
    - '?&dir'
  - method:
    - postfix
detect:
  - response:
    - body: '(COMSPEC).*(REMOTE_ADDR).*(REMOTE_HOST)'
    - body: '(Volume in drive).*(Directory of)'
    - body: '(HOMEDRIVE).*(SystemDrive).*(NUMBER_OF_PROCESSORS)'
meta-info:
  - type: rce
  - threat: 90
  - applicable_for:
    - fast
  - tags:
    - CVE-2019-0232
    - Remote Code Execution
    - RCE
    - Apache Tomcat