Check for records before matching a string.

corelight · Sep 21, 2021 · 1defb48 · 1defb48
1 parent 9f059ae
commit 1defb48
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/scripts/omigod.zeek b/scripts/omigod.zeek
@@ -82,7 +82,7 @@ event http_all_headers(c: connection, is_orig: bool, hlist: mime_header_list)
         return;
 
     # The exploit is triggered when a payload XML is POSTed
-    if (c$http$method != "POST")
+    if ( !c?http || !c$http?method || c$http$method != "POST")
         return;
 
     # Throw out small list of headers