Samsung MagicINFO 9 Server Path Traversal and Arbitrary File Upload

let MagicINFOPorts = dynamic([80, 443, 8080, 7001, 8088]);
let SuspiciousExtensions = dynamic(['.jsp', '.aspx', '.php', '.war', '.jspx', '.ashx', '.sh', '.py', '.pl']);
let TraversalPatterns = dynamic(['../', '..\\', '%2e%2e%2f', '%2e%2e/', '..%2f', '%2e%2e%5c']);
union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort has_any (MagicINFOPorts)
  or RequestURL has_any (TraversalPatterns)
  or RequestURL has_any (SuspiciousExtensions)
| where RequestURL contains 'MagicInfo' or DestinationHostName contains 'magicinfo'
  or RequestURL has_any (TraversalPatterns)
| extend CleanURL = tolower(RequestURL)
| where CleanURL has_any (TraversalPatterns) or CleanURL has_any (SuspiciousExtensions)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, RequestMethod, ResponseCode, DeviceAction
| summarize Attempts=count(), Methods=make_set(RequestMethod), URLs=make_set(RequestURL, 10) by SourceIP, DestinationIP, bin(TimeGenerated, 5m)
| where Attempts > 2
| extend AlertSeverity = 'High', CVE = 'CVE-2024-7399'

index=proxy OR index=web OR index=iis
(sourcetype=access_combined OR sourcetype=ms:iis:auto OR sourcetype=cisco:asa OR sourcetype=pan:traffic)
| eval url_lower=lower(uri_path)
| eval has_traversal=if(match(url_lower, "\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f|%2e%2e%5c"), 1, 0)
| eval has_webshell_ext=if(match(url_lower, "\.(jsp|jspx|aspx|ashx|php|war|sh|py|pl)(\?|$)"), 1, 0)
| eval magicinfo_target=if(match(url_lower, "magicinfo") OR match(host, "(?i)magicinfo"), 1, 0)
| where (has_traversal=1 OR has_webshell_ext=1) AND (magicinfo_target=1 OR (dest_port IN (8080, 7001, 8088) AND has_traversal=1))
| stats count AS attempts, values(uri_path) AS urls, values(method) AS methods, values(status) AS response_codes BY src_ip, dest_ip, dest_port, _time span=5m
| where attempts > 1
| eval cve="CVE-2024-7399", severity="critical"
| table _time, src_ip, dest_ip, dest_port, attempts, urls, methods, response_codes, cve, severity

sequence by source.ip with maxspan=2m
  [network where destination.port in (80, 443, 8080, 7001, 8088)
   and (
     url.path like~ "*../*" or
     url.path like~ "*%2e%2e%2f*" or
     url.path like~ "*%2e%2e/*" or
     url.path like~ "*..%2f*"
   )]
  [network where destination.port in (80, 443, 8080, 7001, 8088)
   and (
     url.path like~ "*.jsp*" or
     url.path like~ "*.aspx*" or
     url.path like~ "*.php*" or
     url.path like~ "*.sh*"
   )
   and http.request.method in ("POST", "PUT")
  ]

SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  "HTTP Method",
  "HTTP Response Code",
  COUNT(*) AS attempt_count,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Squid', 'Palo Alto Networks Firewall')
  AND (
    URL ILIKE '%../%'
    OR URL ILIKE '%..\\%'
    OR URL ILIKE '%%2e%2e%2f%'
    OR URL ILIKE '%%2e%2e/%'
    OR URL ILIKE '%..%2f%'
    OR URL ILIKE '%%2e%2e%5c%'
  )
  AND (
    URL ILIKE '%magicinfo%'
    OR destinationport IN (8080, 7001, 8088)
  )
  AND LOGSOURCENAME(logsourceid) NOT ILIKE '%authorized-scanner%'
  AND STARTTIME > NOW() - 3600000
GROUP BY sourceip, destinationip, destinationport, URL, "HTTP Method", "HTTP Response Code"
HAVING attempt_count > 1
ORDER BY attempt_count DESC

_sourceCategory=web/access OR _sourceCategory=network/proxy
| parse regex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*?(?<method>GET|POST|PUT|DELETE|PATCH)\s+(?<uri>\S+).*?(?<status>\d{3})"
| where (
    uri matches "*../*" or
    uri matches "*%2e%2e%2f*" or
    uri matches "*%2e%2e/*" or
    uri matches "*..%2f*" or
    uri matches "*%2e%2e%5c*"
  )
| where (
    uri matches "*magicinfo*" or
    uri matches "*.jsp" or
    uri matches "*.aspx" or
    uri matches "*.php"
  )
| timeslice 5m
| count as attempts by src_ip, uri, method, status, _timeslice
| where attempts > 1
| sort by attempts desc
| fields _timeslice, src_ip, uri, method, status, attempts

rule cve_2024_7399_magicinfo_path_traversal {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2024-7399 exploitation: path traversal and file upload against Samsung MagicINFO 9 Server"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2024-7399"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7399"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.port in (80, 443, 8080, 7001, 8088)
    (
      re.regex($e.network.http.referral_url, `\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f|%2e%2e%5c`) or
      re.regex($e.target.url, `\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f|%2e%2e%5c`) or
      re.regex($e.target.url, `(?i)magicinfo`) or
      (
        $e.network.http.method = "POST" and
        re.regex($e.target.url, `(?i)\.(jsp|jspx|aspx|php|war|sh)$`)
      )
    )

  match:
    $e.principal.ip over 5m

  outcome:
    $risk_score = 85
    $src_ip = array_distinct($e.principal.ip)
    $dst_ip = array_distinct($e.target.ip)
    $urls = array_distinct($e.target.url)
    $event_count = count($e.metadata.id)

  condition:
    #e > 2
}

#event_simpleName IN ("NetworkConnect", "NetworkConnectIP4", "HttpRequest")
| filter TargetPort IN (80, 443, 8080, 7001, 8088)
| filter match(field=URI, pattern="(?i)(\.\./|%2e%2e%2f|%2e%2e/|\.\.|%2e%2e%5c)", flags=ignorecase)
   OR match(field=URI, pattern="(?i)magicinfo", flags=ignorecase)
   OR (HttpMethod="POST" AND match(field=URI, pattern="(?i)\.(jsp|jspx|aspx|php|war|sh)$"))
| eval traversal_indicator=if(match(URI, "(?i)(\.\./|%2e%2e)"), "path_traversal", "file_upload")
| stats count() AS request_count, values(URI) AS request_uris, values(HttpMethod) AS methods BY aid, RemoteAddressIP4, TargetPort, traversal_indicator
| filter request_count > 1
| eval cve="CVE-2024-7399", severity="critical"
| sort -request_count