CVE-2022-20775 — Cisco SD-WAN Path Traversal Exploitation Attempt

union DeviceNetworkEvents, DeviceProcessEvents, DeviceFileEvents
| where TimeGenerated > ago(7d)
| where
    (
        // Network: inbound requests to vManage or vBond API endpoints with traversal sequences
        (ActionType in ('ConnectionSuccess', 'HttpRequestReceived') and
         RemoteUrl has_any ('../', '..\\', '%2e%2e%2f', '%2e%2e/', '..%2f', '%252e%252e') and
         RemoteUrl has_any ('/dataservice/', '/template/', '/device/'))
        or
        // Process: suspicious child processes spawned from SD-WAN daemons
        (InitiatingProcessFileName in~ ('vdaemon', 'vmanage', 'vbond', 'vsmart') and
         FileName in~ ('sh', 'bash', 'python', 'python3', 'curl', 'wget', 'nc', 'ncat'))
        or
        // File: access to sensitive files via path traversal from SD-WAN context
        (InitiatingProcessFileName in~ ('vdaemon', 'vmanage') and
         FolderPath has_any ('/etc/passwd', '/etc/shadow', '/root/', '/home/', '/.ssh/'))
    )
| extend ThreatContext = 'CVE-2022-20775 Cisco SD-WAN Path Traversal'
| project TimeGenerated, DeviceName, ActionType, RemoteUrl, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, ThreatContext

index=network OR index=syslog OR index=cisco_sdwan
| eval combined_field = coalesce(uri_path, request_uri, url, file_path, process_name)
| where (
    (sourcetype IN ("cisco:sdwan", "cisco:ios", "pan:traffic", "nginx:access") AND
     match(combined_field, "(\.\./|%2e%2e%2f|%252e%252e|\.\.%2f|%2e%2e/)") AND
     match(combined_field, "(/dataservice/|/template/|/device/|/vmanage)"))
    OR
    (sourcetype="linux:syslog" AND
     match(process, "(vdaemon|vmanage|vbond|vsmart)") AND
     match(command, "(bash|sh|python|curl|wget|nc\b)"))
    OR
    (sourcetype="linux:audit" AND
     match(exe, "/(vdaemon|vmanage)") AND
     match(name, "(/etc/passwd|/etc/shadow|/.ssh/|/root/)"))
  )
| eval threat_label="CVE-2022-20775 Cisco SD-WAN Path Traversal"
| table _time, host, sourcetype, src_ip, dest_ip, uri_path, process, command, name, threat_label
| sort -_time

sequence by host.name with maxspan=5m
  [network where
    event.type == "connection" and
    (url.path : ("*../*", "*%2e%2e%2f*", "*%252e%252e*", "*..%2f*") and
     url.path : ("*/dataservice/*", "*/template/*", "*/device/*"))
  ] by source.ip
  [process where
    event.type == "start" and
    process.parent.name : ("vdaemon", "vmanage", "vbond", "vsmart") and
    process.name : ("sh", "bash", "python*", "curl", "wget", "nc")
  ] by host.ip

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  URL,
  "Process Name",
  username,
  logsourcename(logsourceid) AS log_source,
  QIDNAME(qid) AS event_name
FROM events
WHERE
  (
    (
      (URL ILIKE '%../%' OR URL ILIKE '%..\\%' OR URL ILIKE '%2e%2e%2f%' OR URL ILIKE '%252e%252e%' OR URL ILIKE '%..%2f%')
      AND (URL ILIKE '%/dataservice/%' OR URL ILIKE '%/template/%' OR URL ILIKE '%/device/%' OR URL ILIKE '%/vmanage%')
    )
    OR
    (
      "Process Name" ILIKE '%vdaemon%' OR "Process Name" ILIKE '%vmanage%' OR "Process Name" ILIKE '%vbond%'
      AND "Command Line" MATCHES '.*\b(bash|sh|python|curl|wget|nc)\b.*'
    )
  )
  AND LOGSOURCETYPENAME(devicetype) IN ('Cisco SD-WAN', 'Linux OS', 'Apache HTTP Server')
LAST 7 DAYS

_sourceCategory=cisco/sdwan OR _sourceCategory=linux/syslog OR _sourceCategory=network/proxy
| parse regex "(?<traversal_hit>(?:\.\./|%2e%2e%2f|%252e%252e|\.\.%2f|%2e%2e/))" nodrop
| parse regex "(?<sdwan_path>/(?:dataservice|template|device|vmanage)[^\s]*)" nodrop
| parse regex "(?<sdwan_proc>vdaemon|vmanage|vbond|vsmart)" nodrop
| parse regex "(?<susp_cmd>\b(?:bash|sh|python3?|curl|wget|nc|ncat)\b)" nodrop
| where (traversal_hit != "" and sdwan_path != "") or (sdwan_proc != "" and susp_cmd != "")
| fields _sourcehost, _sourcecategory, traversal_hit, sdwan_path, sdwan_proc, susp_cmd, _raw
| count by _sourcehost, traversal_hit, sdwan_proc
| where _count > 0
| sort by _count desc

rule cisco_sdwan_path_traversal_cve_2022_20775 {
  meta:
    author = "df00tech"
    description = "Detects CVE-2022-20775 Cisco SD-WAN path traversal exploitation"
    severity = "CRITICAL"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-20775"

  events:
    (
      // Path traversal in SD-WAN API requests
      ($e1.metadata.event_type = "NETWORK_HTTP" and
       re.regex($e1.network.http.request_url, `(\.\./|%2e%2e%2f|%252e%252e|\.\.%2f)`) and
       re.regex($e1.network.http.request_url, `/(dataservice|template|device|vmanage)`))
      or
      // Suspicious child process from SD-WAN daemon
      ($e1.metadata.event_type = "PROCESS_LAUNCH" and
       re.regex($e1.principal.process.file.full_path, `(vdaemon|vmanage|vbond|vsmart)`) and
       re.regex($e1.target.process.file.full_path, `/(bin/)?(bash|sh|python3?|curl|wget|nc)$`))
      or
      // Sensitive file access from SD-WAN process
      ($e1.metadata.event_type = "FILE_OPEN" and
       re.regex($e1.principal.process.file.full_path, `(vdaemon|vmanage)`) and
       re.regex($e1.target.file.full_path, `(/etc/passwd|/etc/shadow|/root/|/.ssh/)`))
    )

  condition:
    $e1
}

// CVE-2022-20775 — Cisco SD-WAN Path Traversal
#event_simpleName IN (NetworkConnectIP4, ProcessRollup2, DnsRequest)
| filter
    (
      // Network: traversal in URI
      (event_simpleName = "NetworkConnectIP4" AND
       RemoteAddressIP4 != null AND
       (HttpUri = ~"*../*" OR HttpUri = ~"*%2e%2e%2f*" OR HttpUri = ~"*%252e%252e*") AND
       (HttpUri = ~"*/dataservice/*" OR HttpUri = ~"*/template/*" OR HttpUri = ~"*/device/*"))
      OR
      // Process: SD-WAN daemon spawns shell
      (event_simpleName = "ProcessRollup2" AND
       ParentImageFileName IN~ ("vdaemon", "vmanage", "vbond", "vsmart") AND
       ImageFileName IN~ ("sh", "bash", "python", "python3", "curl", "wget", "nc"))
    )
| eval ThreatLabel = "CVE-2022-20775 Cisco SD-WAN Path Traversal"
| select timestamp, ComputerName, UserName, ImageFileName, ParentImageFileName, CommandLine, HttpUri, RemoteAddressIP4, ThreatLabel