JetBrains TeamCity Relative Path Traversal (CVE-2024-27199)

union isfuzzy=true
(
  AzureDiagnostics
  | where Category == "ApplicationGatewayAccessLog"
  | where requestUri_s matches regex @"(?i)/res/[^?]*(?:%2e%2e|\.\.)[^?]*/(?:admin|config|WEB-INF)"
  | project TimeGenerated, requestUri_s, clientIP_s, httpStatus_d, host_s, userAgent_s
),
(
  W3CIISLog
  | where csUriStem matches regex @"(?i)(?:/res/|/update/|/icons/)(?:[^/]*(?:%2e%2e|\.\.)[^/]*/)+"
  | project TimeGenerated, csUriStem, cIP, scStatus, csHost, csUserAgent
),
(
  CommonSecurityLog
  | where DeviceVendor in ("F5", "Palo Alto Networks", "Fortinet", "Cisco")
  | where RequestURL matches regex @"(?i)(?:/res/|/update/).*(?:%2e%2e|%252e%252e|\.\.).*(?:/admin|/config|WEB-INF|server\.xml)"
  | project TimeGenerated, RequestURL, SourceIP, EventOutcome, DestinationHostName, RequestClientApplication
)
| where TimeGenerated > ago(24h)
| extend DecodedPath = replace_string(replace_string(coalesce(requestUri_s, csUriStem, RequestURL), "%2e", "."), "%252e", ".")
| where DecodedPath matches regex @"(?i)(?:\.\./){1,}(?:admin|WEB-INF|conf|config|internal)"
| summarize RequestCount=count(), UniqueEndpoints=dcount(coalesce(requestUri_s, csUriStem, RequestURL)) by SourceIP=coalesce(clientIP_s, cIP, SourceIP), bin(TimeGenerated, 5m)
| where RequestCount >= 3
| extend RiskScore = case(RequestCount >= 20, "Critical", RequestCount >= 10, "High", "Medium")
| project TimeGenerated, SourceIP, RequestCount, UniqueEndpoints, RiskScore

index=web OR index=proxy OR index=waf sourcetype IN ("iis", "apache:access", "nginx:plus:kv", "pan:traffic", "f5:bigip:ltm:access")
| rex field=uri_path "(?i)(?<traversal_raw>(?:%2e%2e|%252e%252e|\.\.)(?:%2f|%252f|/))"
| rex field=cs_uri_stem "(?i)(?<traversal_raw2>(?:%2e%2e|%252e%252e|\.\.)(?:%2f|%252f|/))"
| eval has_traversal=if(isnotnull(traversal_raw) OR isnotnull(traversal_raw2), 1, 0)
| where has_traversal=1
| eval full_path=coalesce(uri_path, cs_uri_stem, url, c_uri)
| where match(full_path, "(?i)/(?:res|update|icons|plugins)/")
| eval decoded_path=replace(replace(replace(full_path, "%252e", "."), "%2e", "."), "%2f", "/")
| where match(decoded_path, "(?i)(?:\.\./)+(?:WEB-INF|admin|config|internal|server\.xml|web\.xml)")
| stats count AS request_count, dc(full_path) AS unique_paths, values(full_path) AS paths, values(status) AS response_codes BY src_ip, dest_host, _time span=5m
| where request_count >= 3
| eval severity=case(request_count >= 20, "critical", request_count >= 10, "high", 1==1, "medium")
| table _time, src_ip, dest_host, request_count, unique_paths, paths, response_codes, severity
| sort -request_count

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   http.request.method in ("GET", "POST") and
   (
     wildcard(url.path, "*/res/*../*") or
     wildcard(url.path, "*/update/*../*") or
     wildcard(url.path, "*/icons/*../*") or
     url.path like~ "*%2e%2e*" or
     url.path like~ "*%252e%252e*"
   ) and
   (
     url.path like~ "*/WEB-INF*" or
     url.path like~ "*/admin*" or
     url.path like~ "*/config*" or
     url.path like~ "*server.xml*" or
     url.path like~ "*web.xml*"
   )
  ] with runs=3

SELECT
  sourceip,
  destinationip,
  URL,
  "HTTP Response Code" AS http_status,
  "User Agent" AS user_agent,
  COUNT(*) AS request_count,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('IBM Security Network IPS (GV)', 'Apache HTTP Server', 'Microsoft IIS', 'Nginx')
  AND (
    LOWER(URL) MATCHES '.*(?:/res/|/update/|/icons/).*(?:%2e%2e|%252e%252e|\\.\\./).*'
    OR LOWER(URL) MATCHES '.*(web-inf|server\\.xml|web\\.xml|/admin/|/config/).*'
  )
  AND (
    LOWER(URL) MATCHES '.*(%2e%2e|%252e).*'
    OR LOWER(URL) MATCHES '.*(\\.\\./){1,}.*'
  )
  AND LOGSOURCENAME(logsourceid) ILIKE '%teamcity%'
  AND starttime > NOW() - 86400000
GROUP BY sourceip, destinationip, URL, http_status, user_agent
HAVING COUNT(*) >= 3
ORDER BY request_count DESC
LAST 24 HOURS

_sourceCategory=web/access OR _sourceCategory=proxy/logs OR _sourceCategory=waf
| parse regex "(?<src_ip>\\d+\\.\\d+\\.\\d+\\.\\d+).*?(?:GET|POST|PUT)\\s+(?<request_path>[^\\s]+)"
| where request_path matches /(?i)\/(?:res|update|icons|plugins)\//
| where request_path matches /(?i)(?:%2e%2e|%252e%252e|\.\.\/)/
| where request_path matches /(?i)(?:WEB-INF|web\.xml|server\.xml|\/admin\/|\/config\/|internal)/
| urldecode(request_path) as decoded_path
| timeslice 5m
| stats count as request_count, dcount(request_path) as unique_paths by src_ip, _timeslice
| where request_count >= 3
| fields _timeslice, src_ip, request_count, unique_paths
| sort by request_count desc

rule cve_2024_27199_teamcity_path_traversal {
  meta:
    author = "df00tech"
    description = "Detects CVE-2024-27199 JetBrains TeamCity relative path traversal exploitation"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-27199"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = /GET|POST/
    $e.network.http.request_url = /(?i)\/(?:res|update|icons|plugins)\//
    (
      $e.network.http.request_url = /(?i)%2e%2e/ or
      $e.network.http.request_url = /(?i)%252e%252e/ or
      $e.network.http.request_url = /\.\.\//
    )
    (
      $e.network.http.request_url = /(?i)WEB-INF/ or
      $e.network.http.request_url = /(?i)server\.xml/ or
      $e.network.http.request_url = /(?i)\/admin\// or
      $e.network.http.request_url = /(?i)\/config\//
    )
    $ip = $e.principal.ip

  match:
    $ip over 5m

  condition:
    #e >= 3
}

#event_simpleName=NetworkReceiveAccepted OR #event_simpleName=HttpRequest
| LocalPort = 8111 OR LocalPort = 443 OR LocalPort = 80
| HttpPath = /(?i)\/(?:res|update|icons|plugins)\//
| HttpPath = /(?i)(?:%2e%2e|%252e%252e|\.\.\/)/
| HttpPath = /(?i)(?:WEB-INF|web\.xml|server\.xml|\/admin\/|\/config\/)/
| stats count() as request_count by RemoteAddressIP4, HttpPath, bin(timestamp, 5min)
| where request_count >= 3
| sort request_count desc
| rename RemoteAddressIP4 as attacker_ip, HttpPath as traversal_path