falco-cve-2023-27351.yaml

- macro: papercut_http_request
  condition: (evt.arg.data contains '/app?service=' and evt.arg.data contains '/SetupCompleted')

- rule: PaperCut Authentication Bypass CVE-2023-27351 Exploitied
  desc: Detects the exploitation of CVE-2023-27351 inorder to bypass authentication in Papercut.
  condition: >
    evt.dir=< and
    evt.type=read and
    papercut_http_request and
    (fd.typechar=4 or fd.typechar=6)
  output: "Possible Authentication Bypass CVE-2023-27351 detected (event=%evt.type server_ip=%fd.sip server_port=%fd.sport proto=%fd.l4proto fd.cip=%fd.cip parent=%proc.pname process=%proc.name container_id=%container.id)"
  priority: WARNING
  tags: [host,container,CVE_2023_2735,PaperCut,auth_bypass]