CVE-2024-6387.yaml

id: CVE-2024-6387

info:
  name: Detect RegreSSHion
  author: Brandon Lynch
  severity: Critical
  description: Detects CVE-2024-6387 (RegreSSHion) by OpenSSH software version.
  classification:
    cve-id: CVE-2024-6387
  metadata:
    max-request: 2
    vendor: OpenSSH
    product: OpenSSH
  tags: cve,cve2024,regresshion,openssh,ssh

tcp:
  - host:
      - '{{Hostname}}'
    port: 22
    matchers:
      - type: regex
        part: body
        regex:
          - 'OpenSSH_(8\.[5-9]p?[12]?|9\.[0-7]p?[12]?|[0-3]\.[0-9]p?[12]?|4\.[0-3]p?[12]?)'