Strapi Cleartext Storage of Sensitive Information (CVE-2023-22894)

let strapiSensitivePaths = dynamic(["/content-manager/collection-types", "/content-type-builder", "/admin/users", "/api/users", "/_health", "/admin/content-manager"]);
let sensitiveFields = dynamic(["password", "resetPasswordToken", "apiToken", "accessKey", "secret", "connectionString", "database"]);
union isfuzzy=true W3CIISLog, CommonSecurityLog
| where TimeGenerated > ago(1d)
| extend reqUri = tolower(coalesce(column_ifexists("csUriStem", ""), column_ifexists("RequestURL", "")))
| extend srcIp = coalesce(column_ifexists("cIP", ""), column_ifexists("SourceIP", ""))
| where reqUri has_any (strapiSensitivePaths) or reqUri has_any (sensitiveFields)
| summarize RequestCount = count(), Paths = make_set(reqUri, 50) by srcIp, bin(TimeGenerated, 15m)
| where RequestCount > 5
| project TimeGenerated, srcIp, RequestCount, Paths

index=web OR index=proxy sourcetype IN ("ms:iis","nginx:access","apache:access") (uri_path="*/content-manager/*" OR uri_path="*/content-type-builder*" OR uri_path="*/admin/users*" OR uri_path="*/api/users*" OR uri_query="*password*" OR uri_query="*apiToken*" OR uri_query="*connectionString*" OR uri_query="*secret*")
| stats count AS hits values(uri_path) AS paths dc(uri_path) AS distinct_paths by src_ip, _time span=15m
| where hits > 5
| sort - hits

sequence by source.ip with maxspan=15m
  [ network where url.path like~ "*/content-manager/*" or url.path like~ "*/content-type-builder*" ]
  [ network where url.path like~ "*/api/users*" or url.query like~ "*password*" or url.query like~ "*apiToken*" or url.query like~ "*connectionString*" ]

SELECT sourceip, COUNT(*) AS hits, UniqueCount("URL") AS distinct_urls FROM events WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server','Microsoft IIS','Nginx') AND ("URL" ILIKE '%/content-manager/%' OR "URL" ILIKE '%/content-type-builder%' OR "URL" ILIKE '%/api/users%' OR "URL" ILIKE '%password%' OR "URL" ILIKE '%apiToken%' OR "URL" ILIKE '%connectionString%') GROUP BY sourceip HAVING hits > 5 LAST 1 HOURS

_sourceCategory=*web* OR _sourceCategory=*proxy* ("/content-manager/" OR "/content-type-builder" OR "/api/users" OR "password" OR "apiToken" OR "connectionString" OR "secret")
| parse "* - * [*] \"* * *\" * *" as src_ip, auth, ts, method, url, proto, status, bytes nodrop
| where url matches "*content-manager*" or url matches "*content-type-builder*" or url matches "*api/users*" or url matches "*password*" or url matches "*apiToken*" or url matches "*connectionString*"
| count as hits by src_ip, url
| where hits > 5
| sort by hits desc

rule strapi_cve_2023_22894_cleartext_secret_access {
  meta:
    author = "Argus"
    description = "Detects access to Strapi config/user endpoints and sensitive-field requests tied to CVE-2023-22894"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.referral_url, `(?i)content-manager|content-type-builder`) or
      re.regex($e.target.url, `(?i)/content-manager/|/content-type-builder|/api/users|password|apiToken|connectionString|secret`)
    )
    $ip = $e.principal.ip
  match:
    $ip over 15m
  condition:
    #e > 5
}

#event_simpleName=/HttpRequest|DnsRequest/ OR #repo="web_logs"
| in(field="UrlPath", values=["*/content-manager/*", "*/content-type-builder*", "*/api/users*"], ignoreCase=true)
| groupBy([aid, SourceIp], function=[count(as=hits), collect([UrlPath])])
| hits > 5