Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
3
3
1
Platforms
2
1
Products / Services
3
3
2
1
1
MITRE Techniques
2
1
CVEs
71
71
64
58
49
Detects exploitation attempts against Joomla websites targeting CVE-2023-23752. This vulnerability allows an unauthenticated attacker to disclose sensitive information, such as configuration details or user data, by crafting specific GET requests to the Joomla API.
This rule detects attempts to exploit CVE-2023-23752 in Joomla. The exploit involves unauthenticated access to sensitive configuration information or user data via specific API endpoints. The rule looks for HTTP GET requests to '/api/index.php/v1/users?public=true' or '/api/index.php/v1/config/application?public=true' followed by a 200 HTTP status code, indicating a successful information disclosure.
This rule detects potential exploitation attempts of CVE-2023-23752, an improper access check vulnerability in Joomla's web service endpoints. The detection specifically looks for GET requests to the '/api/index.php/v1/' path with the 'public=true' query parameter, which is indicative of an attempt to bypass access controls.
