SimpleHelp Missing Authorization Vulnerability (CVE-2024-57726)

union DeviceNetworkEvents, DeviceProcessEvents, DeviceFileEvents
| where TimeGenerated > ago(7d)
| where (
    (ActionType in ("NetworkConnectionSuccess", "InboundConnectionAccepted") and RemotePort in (80, 443, 5850, 5900) and InitiatingProcessFileName has_any ("jetty", "java", "SimpleHelp"))
    or (FileName has_any ("SimpleHelp", "simplehelp") and FolderPath has_any ("server", "remote"))
    or (ProcessCommandLine has_any ("SimpleHelp", "/api/", "simplehelp") and ActionType == "ProcessCreated")
)
| extend SuspiciousIndicator = case(
    RemotePort in (5850, 5900), "Non-standard SimpleHelp port",
    ProcessCommandLine has "/admin" and not InitiatingProcessAccountName has_any ("SYSTEM", "Administrator"), "Unauthorized admin path access",
    "General SimpleHelp activity"
)
| project TimeGenerated, DeviceName, AccountName, ActionType, RemoteIP, RemotePort, FileName, ProcessCommandLine, SuspiciousIndicator
| order by TimeGenerated desc

index=* sourcetype IN ("iis", "apache", "jetty:access", "simplehelp", "wineventlog", "sysmon")
| eval is_simplehelp_traffic = if(match(uri_path, "(?i)(simplehelp|/api/|/admin|/tech/|/customer/)") OR match(process_name, "(?i)(SimpleHelp|simplehelp-server)"), 1, 0)
| where is_simplehelp_traffic=1
| eval auth_bypass_indicator = case(
    match(uri_path, "(?i)(/admin|/operator|/api/admin)") AND (http_status IN ("200", "201", "204")) AND isnull(auth_header), "Unauthenticated admin access",
    match(uri_path, "(?i)/api/") AND method="POST" AND http_status="200" AND isnull(user), "Unauthenticated API call",
    match(process_name, "(?i)SimpleHelp") AND match(CommandLine, "(?i)(cmd\.exe|powershell|bash|sh )"), "Suspicious child process from SimpleHelp",
    true(), "SimpleHelp activity"
)
| where auth_bypass_indicator != "SimpleHelp activity"
| stats count as event_count, values(src_ip) as source_ips, values(uri_path) as accessed_paths, values(auth_bypass_indicator) as indicators by host, _time
| sort -event_count

sequence by host.name with maxspan=5m
  [network where process.name like~ "*SimpleHelp*" or process.name like~ "*java*"
   and network.direction == "ingress"
   and destination.port in (80, 443, 5850, 5900)]
  [any where
    (http.request.method in ("POST", "PUT") and url.path like~ "*/admin*" and not user.name : ("*admin*", "*operator*"))
    or (process.parent.name like~ "*SimpleHelp*" and process.name in ("cmd.exe", "powershell.exe", "bash", "sh"))
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  URL,
  "HTTP Method",
  "HTTP Status Code",
  LOGSOURCENAME(logsourceid) AS log_source,
  CATEGORYDESC(category) AS event_category
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Apache HTTP Server', 'Nginx')
  AND (
    (URL ILIKE '%/admin%' OR URL ILIKE '%/api/admin%' OR URL ILIKE '%/operator%')
    AND (username IS NULL OR username = '')
    AND "HTTP Status Code" IN ('200', '201', '204')
  )
  OR (
    LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
    AND "Process Name" ILIKE '%SimpleHelp%'
    AND "Child Process Name" ILIKE ANY ('%cmd.exe%', '%powershell.exe%', '%bash%', '%sh%')
  )
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=web/simplehelp OR _sourceCategory=windows/sysmon OR _sourceCategory=linux/syslog
| parse "method=*" as http_method nodrop
| parse "uri=*" as request_uri nodrop
| parse "status=*" as http_status nodrop
| parse "user=*" as request_user nodrop
| parse "process=*" as process_name nodrop
| parse "parent_process=*" as parent_process nodrop
| where (
    (request_uri matches "*/admin*" OR request_uri matches "*/api/admin*" OR request_uri matches "*/operator*")
    AND (isNull(request_user) OR request_user = "")
    AND http_status in ("200", "201", "204")
  )
  OR (
    parent_process matches "*SimpleHelp*"
    AND process_name in ("cmd.exe", "powershell.exe", "bash", "sh", "/bin/sh", "/bin/bash")
  )
| count by _sourceHost, request_uri, http_status, process_name, parent_process
| sort by _count desc

rule cve_2024_57726_simplehelp_auth_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2024-57726 SimpleHelp Missing Authorization"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-57726"

  events:
    (
      $e1.metadata.event_type = "NETWORK_HTTP"
      and (
        re.regex($e1.target.url, `(?i)(/admin|/api/admin|/operator|/tech/login)`)
        and $e1.network.http.response_code in (200, 201, 204)
        and not $e1.principal.user.userid != ""
      )
    )
    or
    (
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e1.principal.process.file.full_path, `(?i)SimpleHelp`)
      and re.regex($e1.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|/bin/bash|/bin/sh)`)
    )

  condition:
    $e1
}

#event_simpleName IN (NetworkConnectIP4, ProcessRollup2, DnsRequest)
| $ProductType = "SimpleHelp"
| case {
    #event_simpleName = "NetworkConnectIP4":
      RemotePort IN (5850, 5900, 80, 443)
      AND ImageFileName CONTAINS "SimpleHelp"
      | eval ThreatIndicator = "SimpleHelp network activity on monitored port";
    #event_simpleName = "ProcessRollup2":
      ParentBaseFileName CONTAINS "SimpleHelp"
      AND FileName IN ("cmd.exe", "powershell.exe", "bash", "sh")
      | eval ThreatIndicator = "Suspicious child process from SimpleHelp parent";
    #event_simpleName = "DnsRequest":
      DomainName CONTAINS "simplehelp"
      AND NOT DomainName CONTAINS "simple-help.com"
      | eval ThreatIndicator = "DNS query to non-canonical SimpleHelp domain";
  }
| stats count() AS EventCount, values(ThreatIndicator) AS Indicators, values(LocalAddressIP4) AS LocalIPs, values(RemoteAddressIP4) AS RemoteIPs BY ComputerName, UserName, FileName, CommandLine
| where EventCount > 0
| sort EventCount desc