DD-WRT Stack-Based Buffer Overflow Exploitation Attempt (CVE-2021-27137)

// Requires network/firewall logs ingested via CommonSecurityLog or similar for embedded device traffic
CommonSecurityLog
| where DeviceVendor has "DD-WRT" or DestinationPort in (80, 443, 8080)
| where RequestURL has_any ("cgi-bin", "apply.cgi", "management.asp") 
| extend RequestLength = strlen(RequestURL)
| where RequestLength > 2000 or RequestURL matches regex @"(%[0-9A-Fa-f]{2}){100,}"
| summarize RequestCount = count(), SampleRequests = make_set(RequestURL, 5) by SourceIP, DestinationIP, bin(TimeGenerated, 5m)
| where RequestCount >= 3
| project TimeGenerated, SourceIP, DestinationIP, RequestCount, SampleRequests

index=network sourcetype=cisco:asa OR sourcetype=fw:generic OR sourcetype=stream:http
| eval req_len=len(uri)
| where (dest_port=80 OR dest_port=443 OR dest_port=8080) AND (like(uri, "%cgi-bin%") OR like(uri, "%apply.cgi%") OR like(uri, "%management.asp%"))
| where req_len > 2000 OR match(uri, "(%[0-9A-Fa-f]{2}){100,}")
| stats count as request_count, values(uri) as sample_uris by src_ip, dest_ip, _time span=5m
| where request_count >= 3

network where event.category == "network" and
  destination.port in (80, 443, 8080) and
  url.original : ("*cgi-bin*", "*apply.cgi*", "*management.asp*") and
  (length(url.original) > 2000 or url.original : "*%*%*%*%*%*%*%*%*%*")
[sequence by source.ip
  [network where destination.port in (80, 443, 8080) and url.original : ("*cgi-bin*", "*apply.cgi*", "*management.asp*")]
  [network where destination.port in (80, 443, 8080) and url.original : ("*cgi-bin*", "*apply.cgi*", "*management.asp*")]]

SELECT sourceip, destinationip, destinationport, URL, COUNT(*) as request_count
FROM events
WHERE (destinationport = 80 OR destinationport = 443 OR destinationport = 8080)
AND (URL ILIKE '%cgi-bin%' OR URL ILIKE '%apply.cgi%' OR URL ILIKE '%management.asp%')
AND (LENGTH(URL) > 2000 OR URL ILIKE '%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25')
GROUP BY sourceip, destinationip, destinationport, URL
HAVING COUNT(*) >= 3
LAST 1 HOURS

_sourceCategory=network/firewall OR _sourceCategory=web/proxy
| where dest_port matches "80" or dest_port matches "443" or dest_port matches "8080"
| where uri matches "*cgi-bin*" or uri matches "*apply.cgi*" or uri matches "*management.asp*"
| parse regex field=uri "(?<uri_len>.{2000,})" nodrop
| if (isNull(uri_len) and !(uri matches "*%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25%25*"), "benign", "suspicious") as verdict
| where verdict = "suspicious"
| count by src_ip, dest_ip, uri
| where _count >= 3

rule dd_wrt_cgi_buffer_overflow_attempt {
  meta:
    author = "df00tech"
    description = "Detects oversized or encoded requests to DD-WRT CGI management endpoints (CVE-2021-27137)"
    severity = "HIGH"
    cve = "CVE-2021-27137"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.port = 80 or $e.target.port = 443 or $e.target.port = 8080
    $e.network.http.method = "GET" or $e.network.http.method = "POST"
    (re.regex($e.target.url, `(?i)(cgi-bin|apply\.cgi|management\.asp)`))
    (strings.length($e.target.url) > 2000 or re.regex($e.target.url, `(%[0-9A-Fa-f]{2}){100,}`))
  match:
    $e.principal.ip over 5m
  condition:
    $e and #e >= 3
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| RemotePort in (80, 443, 8080)
| RequestURI=/*cgi-bin*/ OR RequestURI=/*apply.cgi*/ OR RequestURI=/*management.asp*/
| RequestURILength > 2000 OR RequestURI=/(%[0-9A-Fa-f]{2}){100,}/
| groupBy([LocalIP, RemoteIP], function=([count(as=RequestCount)]))
| RequestCount >= 3