GitLab SSRF via Import Feature (CVE-2021-39935)

union CommonSecurityLog, W3CIISLog
| where TimeGenerated > ago(7d)
| where (RequestURL has_any ("/api/v4/projects", "/import", "/integrations") or csUriStem has_any ("/api/v4/projects", "/import", "/integrations"))
| where (RequestURL matches regex @"(169\.254\.169\.254|metadata\.google\.internal|100\.100\.100\.200|localhost|127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)" or csUriQuery matches regex @"(169\.254\.169\.254|metadata\.google\.internal|localhost|127\.|10\.|192\.168\.)")
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, RequestURL, csUriStem, csUriQuery, RequestMethod, ResponseCode, Activity
| order by TimeGenerated desc

index=web OR index=proxy sourcetype IN ("access_combined", "nginx:access", "iis", "pan:traffic")
| search (uri_path="*/api/v4/projects*" OR uri_path="*/import*" OR uri_path="*/integrations*")
| eval ssrf_indicator=if(match(uri_query, "(169\.254\.169\.254|metadata\.google\.internal|100\.100\.100\.200|localhost|127\\.|10\\.|192\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.)"), 1, 0)
| where ssrf_indicator=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(uri_query) as queries by src_ip, dest_ip, http_method, status
| sort -count

sequence by source.ip with maxspan=5m
  [network where event.dataset in ("nginx.access", "apache.access") and
   url.path like~ "*/api/v4/projects*" or url.path like~ "*/import*" or url.path like~ "*/integrations*"]
  [network where event.dataset in ("nginx.access", "apache.access") and
   (destination.ip == "169.254.169.254" or
    destination.ip == "100.100.100.200" or
    CIDR(destination.ip, "127.0.0.0/8") or
    CIDR(destination.ip, "10.0.0.0/8") or
    CIDR(destination.ip, "172.16.0.0/12") or
    CIDR(destination.ip, "192.168.0.0/16"))]

SELECT sourceip, destinationip, URL, "HTTP Method", "HTTP Response Code", starttime, QIDNAME(qid) as EventName
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Microsoft IIS')
AND (URL IMATCHES '.*(/api/v4/projects|/import|/integrations).*')
AND (URL IMATCHES '.*(169\.254\.169\.254|metadata\.google\.internal|100\.100\.100\.200|127\.|localhost).*'
     OR INCIDR('10.0.0.0/8', destinationip)
     OR INCIDR('192.168.0.0/16', destinationip)
     OR INCIDR('172.16.0.0/12', destinationip))
LAST 7 DAYS
ORDER BY starttime DESC

_sourceCategory=web/access OR _sourceCategory=nginx/access OR _sourceCategory=iis/access
| parse regex "(?P<src_ip>\d+\.\d+\.\d+\.\d+)" nodrop
| where _raw matches /(\/api\/v4\/projects|\/import|\/integrations)/
| where _raw matches /(169\.254\.169\.254|metadata\.google\.internal|100\.100\.100\.200|127\.0\.0\.1|localhost)/
| parse regex "(?P<status_code>\d{3})" nodrop
| count by src_ip, status_code
| sort by _count desc

rule gitlab_ssrf_cve_2021_39935 {
  meta:
    author = "df00tech"
    description = "Detects SSRF exploitation attempts against GitLab import/integration APIs (CVE-2021-39935)"
    severity = "HIGH"
    priority = "HIGH"

  events:
    $req.metadata.event_type = "NETWORK_HTTP"
    $req.target.hostname = /gitlab/
    (
      $req.target.url = /\/api\/v4\/projects/ or
      $req.target.url = /\/import/ or
      $req.target.url = /\/integrations/
    )
    (
      $req.target.url = /169\.254\.169\.254/ or
      $req.target.url = /metadata\.google\.internal/ or
      $req.target.url = /100\.100\.100\.200/ or
      $req.target.url = /127\.0\.0\.1/ or
      $req.target.url = /localhost/
    )

  condition:
    $req
}

#event_simpleName=NetworkConnectIP4
| NetworkRemoteIP in ("169.254.169.254", "100.100.100.200", "127.0.0.1")
  OR (NetworkRemoteIP startswith "10." AND ImageFileName = "/usr/bin/gitlab*")
  OR (NetworkRemoteIP startswith "192.168." AND ImageFileName = "/usr/bin/gitlab*")
| join {#event_simpleName=ProcessRollup2 | ImageFileName=/gitlab/ | fields ProcessStartTime, UserName, CommandLine, ParentProcessId, TargetProcessId} key=[TargetProcessId], field=[ContextProcessId]
| eval ssrf_risk=if(NetworkRemoteIP=="169.254.169.254" OR NetworkRemoteIP=="100.100.100.200", "critical", "high")
| table _time, ComputerName, UserName, ImageFileName, CommandLine, NetworkRemoteIP, NetworkRemotePort, ssrf_risk
| sort by ssrf_risk asc, _time desc