Digiever DS-2105 Pro Missing Authorization Exploitation (CVE-2023-52163)

union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort in (80, 443, 8080, 8443, 554, 37777)
| where RequestURL has_any ("/cgi-bin/", "/admin/", "/system/", "/config/", "/api/", "/setup")
| where isempty(RequestContext) or RequestContext !has "Authorization"
| extend DeviceVendor_norm = tolower(DeviceVendor)
| where DeviceVendor_norm has_any ("digiever", "nvr", "ds-2105")
    or UserAgent has_any ("digiever", "DS-2105")
    or RequestURL has_any ("digiever", "ds2105")
| summarize RequestCount = count(), UniqueIPs = dcount(SourceIP), URLs = make_set(RequestURL, 20) by DestinationIP, bin(TimeGenerated, 5m)
| where RequestCount > 5 or UniqueIPs > 2
| extend AlertSeverity = iff(RequestCount > 20, "High", "Medium")
| project TimeGenerated, DestinationIP, RequestCount, UniqueIPs, URLs, AlertSeverity

index=network OR index=proxy OR index=firewall
| where _time > relative_time(now(), "-24h")
| search (dest_port IN (80, 443, 8080, 8443, 554, 37777))
    AND (uri_path="*/cgi-bin/*" OR uri_path="*/admin/*" OR uri_path="*/system/*" OR uri_path="*/config/*" OR uri_path="*/api/*" OR uri_path="*/setup*")
| eval has_auth=if(isnull(http_header_authorization) OR http_header_authorization="", "no", "yes")
| where has_auth="no"
| eval is_digiever=if(
    like(lower(vendor),"%digiever%") OR like(lower(product),"%ds-2105%") OR like(lower(http_user_agent),"%digiever%"),
    1, 0)
| eval suspicious_target=if(
    match(dest_ip, "^192\.168\.") OR match(dest_ip, "^10\.") OR match(dest_ip, "^172\.(1[6-9]|2[0-9]|3[01])\."),
    "internal", "external")
| stats count AS request_count, dc(src_ip) AS unique_sources, values(uri_path) AS paths BY dest_ip, span(_time, 5m)
| where request_count > 5 OR unique_sources > 2
| eval severity=if(request_count > 20, "high", "medium")
| table _time, dest_ip, request_count, unique_sources, paths, severity

sequence by destination.ip with maxspan=5m
  [network where event.category == "network" and
   destination.port in (80, 443, 8080, 8443, 554, 37777) and
   (
     url.path like~ "*/cgi-bin/*" or
     url.path like~ "*/admin/*" or
     url.path like~ "*/system/*" or
     url.path like~ "*/config/*" or
     url.path like~ "*/setup*"
   ) and
   not (http.request.headers.authorization : "*")]
  [network where event.category == "network" and
   destination.port in (80, 443, 8080, 8443, 554, 37777) and
   http.response.status_code in (200, 201, 204)]
| where #sequence >= 2

SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  COUNT(*) AS request_count,
  COUNT(DISTINCT sourceip) AS unique_sources,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Palo Alto PA Series', 'Cisco ASA', 'Juniper SRX', 'Proxy')
  AND destinationport IN (80, 443, 8080, 8443, 554, 37777)
  AND (
    URL ILIKE '%/cgi-bin/%'
    OR URL ILIKE '%/admin/%'
    OR URL ILIKE '%/system/%'
    OR URL ILIKE '%/config/%'
    OR URL ILIKE '%/setup%'
    OR URL ILIKE '%/api/%'
  )
  AND ("Authorization" NOT IN HEADERS OR HEADERS IS NULL)
  AND DATEFORMAT(starttime, 'YYYY-MM-dd') = DATEFORMAT(NOW(), 'YYYY-MM-dd')
GROUP BY sourceip, destinationip, destinationport, URL
HAVING request_count > 5 OR unique_sources > 2
ORDER BY request_count DESC
LAST 24 HOURS

_index=network OR _index=proxy
| where %"destination.port" in ("80", "443", "8080", "8443", "554", "37777")
| where matches(%"url.path", "(?i).*(cgi-bin|admin|system|config|setup|api).*")
| where isNull(%"http.request.headers.authorization") or isEmpty(%"http.request.headers.authorization")
| timeslice 5m
| stats count as request_count, dcount(%"source.ip") as unique_sources, values(%"url.path") as paths by %"destination.ip", _timeslice
| where request_count > 5 or unique_sources > 2
| if (request_count > 20, "high", "medium") as severity
| sort by request_count desc

rule digiever_ds2105_missing_auth_cve_2023_52163 {
  meta:
    author = "df00tech"
    description = "Detects unauthenticated access to Digiever DS-2105 Pro administrative endpoints (CVE-2023-52163)"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-52163"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1190"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = "GET" or $e.network.http.method = "POST"
    $e.target.port in (80, 443, 8080, 8443, 554, 37777)
    re.regex($e.network.http.referral_url, `(?i).*(cgi-bin|/admin|/system|/config|/setup|/api).*`)
    not re.regex($e.network.http.request_headers, `(?i)authorization:\s*.+`)

  match:
    $e.target.ip over 5m

  outcome:
    $request_count = count_distinct($e.metadata.id)
    $source_ips = array_distinct($e.principal.ip)

  condition:
    #e > 5
}

#event_simpleName=NetworkConnectIP4
| ContextBaseFileName!=""
| RemotePort in (80, 443, 8080, 8443, 554, 37777)
| HttpPath=/(?i).*(cgi-bin|admin|system|config|setup|api).*/
| HttpAuthorizationHeader=""
| groupBy([RemoteAddressIP4, HttpPath], function=[
    count(aid, as=RequestCount),
    dc(LocalAddressIP4, as=UniqueSources),
    min(timestamp, as=FirstSeen),
    max(timestamp, as=LastSeen)
  ])
| RequestCount > 5
| sort(RequestCount, order=desc)
| eval Severity=if(RequestCount > 20, "HIGH", "MEDIUM")
| table(FirstSeen, LastSeen, RemoteAddressIP4, HttpPath, RequestCount, UniqueSources, Severity)