Description
The HTTP Inspect preprocessor (http_inspect) in Snort 2.4.0 through 2.4.4 allows remote attackers to bypass "uricontent" rules via a carriage return (\r) after the URL and before the HTTP declaration.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Snort 2.4.x - URIContent Rules Detection Evasion EDB-27931 · remote · May 31, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20060603 Re: New Snort Bypass - Patch - Bypass of Patch mailing-list
- 20060602 New Snort Bypass - Patch - Bypass of Patch mailing-list
- http://www.demarc.com/support/downloads/patch_20060531
- 20766 third-party-advisory
- 18200 vdb-entry
- 20413 third-party-advisory
- 20060601 Snort HTTP Inspect Pre-Processor Uricontent Bypass mailing-list
- ADV-2006-2119 vdb-entry
- 1018 third-party-advisory
- snort-uricontent-rule-bypass(26855) vdb-entry
- 25837 vdb-entry
- SUSE-SR:2006:014 vendor-advisory
- 1016191 vdb-entry
- [Snort-devel] 20060531 Snort Uricontent Bypass Vulnerability mailing-list
- http://www.snort.org/pub-bin/snortnews.cgi#431
- 20060602 Re: New Snort Bypass - Patch - Bypass of Patch mailing-list