Crafting Suricata Rules: A Deep Dive into CVE-2020–10189 Zoho ManageEngine

Taking CVE-2020–10189 as an example, we’ll write IDS rules to detect this incident through PCAP analysis. This RCE exploit presents numerous detection methods.

with IDS rule validation implemented using Suricata as previously introduced.

Environment

• MAC M1
• OrbStack Container
• Image: jasonish/suricata
• PCAP: The pcap file is a self-recorded capture of the traffic from Metasploit to Zoho in a self-hosted VM environment.

CVE-2020–10189

We won’t discuss the attack method of this CVE here, as there are many related resources and introductions online. We purely focus on how to detect this incident through writing IDS rules.

First, find the trigger point of the attack.

We quickly notice that the attack point could be.

POST /mdm/client/v1/mdmLogUploader?udid=\..\..\..\webapps\DesktopCentral\_chart&filename=logger.zip

We can then write our first rule to detect it.

alert http any any -> any any (msg:"ZOHO exploit attempt to CVE-2020-10189 V1"; sid:10004; flow:to_server,established; content:"POST"; content:"/mdm/client/v1/mdmLogUploader?udid=\\..\\..\\..\\webapps\\DesktopCentral\\_chart&filename=logger.zip"; nocase;)

However, there’s a problem with this approach as we can clearly see a path traversal in front of it. If the attacker changes it to the following, our previously written rule might not detect it.

POST /mdm/client/v1/mdmLogUploader?udid=blue\..\..\..\webapps\DesktopCentral\_chart&filename=logger.zip

Let’s try to modify it to a more generic rule.

alert http any any -> any any (msg:"ZOHO exploit attempt to CVE-2020-10189 V2"; sid:10004; flow:to_server,established; content:"POST"; content:"/mdm/client/v1/mdmLogUploader"; http_uri; content:"udid="; http_uri; content:"..\\webapps\\DesktopCentral"; nocase;)

This example concludes here, with more derivatives to come. How can we detect if the attacker tries to bypass the rule using %5c %2f (?)

Extra Rules

Besides custom rules, we can actually use many generic rules to catch this.

• Path Traversal

• Java Object Deserialization

These rules are for testing and teaching purposes only, not rigorously written, and may easily catch other unrelated items or noise.