Zimbra Collaboration Suite SSRF Exploitation (CVE-2020-7796)

union isfuzzy=true
(
  W3CIISLog
  | where csUriStem has_any ("/zimlet/", "/service/proxy", "/service/extension/zimbrabackup", "/Microsoft-Server-ActiveSync")
  | where csUriQuery has_any ("target=", "host=", "url=", "backend=", "redirect=")
  | where csUriQuery matches regex @"(?i)(target|host|url|backend|redirect)=https?://"
  | extend SuspiciousTarget = extract(@"(?i)(?:target|host|url|backend|redirect)=([^&\s]+)", 1, csUriQuery)
  | where SuspiciousTarget matches regex @"(?i)(169\.254\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|localhost|127\.0\.0\.1|::1|metadata\.google|metadata\.internal|169\.254\.169\.254)"
  | project TimeGenerated, cIP, csHost, csMethod, csUriStem, csUriQuery, scStatus, SuspiciousTarget, Computer
)
,
(
  CommonSecurityLog
  | where DeviceVendor has_any ("Zimbra", "Synacor")
  | where RequestURL has_any ("/service/proxy", "/zimlet/", "/service/extension")
  | where RequestURL has_any ("target=", "host=", "url=")
  | project TimeGenerated, SourceIP, DestinationIP, RequestURL, DeviceVendor, DeviceProduct, Activity
)
| extend AccountName = coalesce(csHost, DestinationIP)
| summarize RequestCount = count(), UniqueTargets = dcount(SuspiciousTarget), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP = coalesce(cIP, SourceIP), AccountName
| where RequestCount >= 1
| extend RiskScore = case(RequestCount > 20, "High", RequestCount > 5, "Medium", "Low")
| project FirstSeen, LastSeen, SourceIP, AccountName, RequestCount, UniqueTargets, RiskScore

index=web OR index=proxy OR index=iis sourcetype IN ("iis", "access_combined", "zimbra:access", "pan:traffic")
(uri_path IN ("/service/proxy", "/zimlet/*", "/service/extension/*") OR url IN ("/service/proxy*", "/zimlet/*"))
(uri_query="*target=*" OR uri_query="*host=*" OR uri_query="*url=http*" OR uri_query="*backend=*" OR uri_query="*redirect=http*")
| rex field=uri_query "(?i)(?:target|host|url|backend|redirect)=(?<ssrf_target>[^&\s]+)"
| where match(ssrf_target, "(?i)(169\.254\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|localhost|127\.0\.0\.1|metadata\.google|metadata\.internal|169\.254\.169\.254)")
| eval severity=case(
    match(ssrf_target, "169\.254\.169\.254"), "critical",
    match(ssrf_target, "(?i)(localhost|127\.0\.0\.1|::1)"), "high",
    true(), "medium"
  )
| stats count AS request_count, dc(ssrf_target) AS unique_targets, values(ssrf_target) AS targets, values(status) AS http_statuses, min(_time) AS first_seen, max(_time) AS last_seen BY src_ip, host, uri_path, severity
| where request_count >= 1
| sort -request_count
| convert ctime(first_seen) ctime(last_seen)
| table first_seen, last_seen, src_ip, host, uri_path, ssrf_target, unique_targets, targets, http_statuses, request_count, severity

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   http.request.method in ("GET", "POST") and
   url.path : ("/service/proxy*", "/zimlet/*", "/service/extension/*") and
   url.query : ("*target=http*", "*host=http*", "*url=http*", "*backend=http*", "*redirect=http*") and
   (
     url.query : ("*169.254.*", "*127.0.0.1*", "*localhost*", "*10.*", "*192.168.*", "*metadata.google*")
   )
  ]
  [network where event.category == "network" and
   destination.port in (80, 443, 8080, 8443, 8200, 9200, 5601, 3306, 5432, 6379, 27017)
  ]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  magnitude,
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  devicetime > NOW() - 3600000
  AND (
    URL MATCHES '(?i).*/service/proxy.*'
    OR URL MATCHES '(?i).*/zimlet/.*'
    OR URL MATCHES '(?i).*/service/extension/.*'
  )
  AND (
    URL MATCHES '(?i)[?&](target|host|url|backend|redirect)=https?://'
  )
  AND (
    URL MATCHES '(?i)(169\.254\.|127\.0\.0\.1|localhost|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|\.internal|metadata\.google)'
  )
ORDER BY devicetime DESC
LIMIT 1000

_sourceCategory=web/zimbra OR _sourceCategory=iis OR _sourceCategory=nginx
| where (%"cs-uri-stem" matches "/service/proxy*" OR %"cs-uri-stem" matches "/zimlet/*" OR url matches "/service/proxy*" OR url matches "/zimlet/*")
| where (%"cs-uri-query" matches "*target=http*" OR %"cs-uri-query" matches "*host=http*" OR %"cs-uri-query" matches "*url=http*" OR query matches "*target=http*" OR query matches "*url=http*")
| parse regex "(?i)(?:target|host|url|backend|redirect)=(?<ssrf_target>[^&\s]+)"
| where ssrf_target matches "*169.254.*" OR ssrf_target matches "*127.0.0.1*" OR ssrf_target matches "*localhost*" OR ssrf_target matches "*10.*" OR ssrf_target matches "*192.168.*" OR ssrf_target matches "*metadata*"
| eval target_class = if(ssrf_target matches "*169.254.169.254*", "metadata-service", if(ssrf_target matches "*127.0.0.1*" OR ssrf_target matches "*localhost*", "loopback", "internal-network"))
| count by _sourceHost, src_ip, ssrf_target, target_class
| sort by _count desc

rule zimbra_ssrf_cve_2020_7796 {
  meta:
    author = "df00tech"
    description = "Detects SSRF exploitation attempts targeting Zimbra Collaboration Suite CVE-2020-7796"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2020-7796"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $request.metadata.event_type = "NETWORK_HTTP"
    $request.target.url != ""
    (
      re.regex($request.target.url, `(?i)/service/proxy`) or
      re.regex($request.target.url, `(?i)/zimlet/`) or
      re.regex($request.target.url, `(?i)/service/extension/`)
    )
    re.regex($request.target.url, `(?i)[?&](target|host|url|backend|redirect)=https?://`)
    (
      re.regex($request.target.url, `169\.254\.`) or
      re.regex($request.target.url, `127\.0\.0\.1`) or
      re.regex($request.target.url, `(?i)localhost`) or
      re.regex($request.target.url, `(?i)metadata\.google`) or
      re.regex($request.target.url, `(?i)\.internal`)
    )
    $request.principal.ip = $source_ip

  match:
    $source_ip over 10m

  outcome:
    $request_count = count_distinct($request.target.url)
    $target_hosts = array_distinct($request.target.hostname)

  condition:
    #request > 0
}

#event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6", "HttpRequest")
| $url = coalesce(HttpUrl, TargetUrl, "")
| $uri_path = parse_uri($url, "path")
| $uri_query = parse_uri($url, "query")
| $src_ip = coalesce(LocalAddressIP4, LocalAddressIP6, RemoteAddressIP4, "")
| where
  ($uri_path =~ "/service/proxy" OR $uri_path =~ "/zimlet/" OR $uri_path =~ "/service/extension/")
  AND ($uri_query =~ "target=http" OR $uri_query =~ "host=http" OR $uri_query =~ "url=http" OR $uri_query =~ "backend=http")
  AND (
    $uri_query =~ "169\.254\." OR
    $uri_query =~ "127\.0\.0\.1" OR
    $uri_query =~ "localhost" OR
    $uri_query =~ "10\." OR
    $uri_query =~ "192\.168\." OR
    $uri_query =~ "metadata\.google"
  )
| eval ssrf_severity = if($uri_query =~ "169\.254\.169\.254", "critical", "high")
| stats count() AS request_count, values($url) AS sampled_urls BY aid, ComputerName, $src_ip, ssrf_severity
| sort -request_count