CWP loopback API restoredatabase root command injection via curl

ills3c Intel&Coffee@Ills3C

•updated 7 days ago•1•0•4

Detects a potential command injection attack where a non-root hosting user utilizes curl or wget to relay requests containing shell metacharacters to the root CWP user API endpoint on loopback port 2302 (/v1/restoredatabase/), followed by a root-side MySQL child process spawned with the injected commands.