Suricata Incomplete TCP Handshake Detection Bypass

This strike exploits a content detection bypass in Suricata. Suricata has state dependent connection, and as such will not perform some detection on TCP session which has not completed the TCP handshake and become established. However, many HTTP client applications, such as wget, curl, and some web browsers, will still process data received before the TCP session is established. An attacker could send malicious content during the TCP handshake, before the session is established, and the malicious content would not be processed by Suricata. Successful exploitation would bypass detection by Suricata.