Gladinet CentreStack/Triofox Unauthorized File/Directory Access (CVE-2025-11371)

union DeviceNetworkEvents, DeviceFileEvents, W3CIISLog
| where TimeGenerated > ago(24h)
| where (
    (ActionType in ("ConnectionSuccess", "InboundConnectionAccepted") and RemoteIPType == "Public" and LocalPort in (80, 443, 8080, 8443))
    or (csUriStem has_any ("/storage/", "/files/", "/share/", "/download/", "/content/") and sc-status in (200, 206))
    or (csUriStem matches regex @"(?i)/(\.\.[\/\\]|%2e%2e[\/\\]|%252e%252e)")
  )
| where DeviceName has_any ("centrestack", "triofox") or csHost has_any ("centrestack", "triofox")
| extend SuspiciousPath = iff(csUriStem matches regex @"(?i)/(windows|system32|etc/passwd|proc/|boot\.ini|\.ssh/|web\.config)", true, false)
| project TimeGenerated, DeviceName, RemoteIP, csUriStem, csMethod, sc-status, SuspiciousPath, csUserAgent
| order by TimeGenerated desc

index=web OR index=iis OR index=proxy
(sourcetype="iis" OR sourcetype="ms:iis:auto" OR sourcetype="access_combined")
| where match(uri_path, "(?i)/(storage|files|share|download|content|data)/") OR match(uri_path, "(?i)(%2e%2e|\.\.[\/\\])")
| where (status=200 OR status=206 OR status=301 OR status=302)
| eval is_traversal=if(match(uri_path, "(?i)(\.\.[\/\\]|%2e%2e|%252e%252e)"), "true", "false")
| eval sensitive_path=if(match(uri_path, "(?i)(windows|system32|etc.passwd|proc|boot\.ini|\.ssh|web\.config|appsettings|connectionstring)"), "true", "false")
| eval external_src=if(NOT match(src_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)"), "true", "false")
| where external_src="true"
| stats count AS request_count, values(uri_path) AS accessed_paths, dc(uri_path) AS unique_paths, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip, dest, http_method, is_traversal, sensitive_path
| where request_count > 5 OR is_traversal="true" OR sensitive_path="true"
| sort -request_count

sequence by source.ip with maxspan=10m
  [network where event.type == "connection" and destination.port in (80, 443, 8080, 8443)
   and not source.ip : ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.1")]
  [http where http.response.status_code in (200, 206, 301, 302)
   and (
     http.request.uri.path : ("/storage/*", "/files/*", "/share/*", "/download/*", "/content/*")
     or http.request.uri.path : ("*../*", "*%2e%2e*", "*%252e%252e*")
     or http.request.uri.path : ("*/web.config*", "*/appsettings*", "*/.ssh/*", "*/etc/passwd*")
   )
  ]

SELECT sourceip, destinationip, destinationport, URL, "HTTP Method", "HTTP Response Code", "HTTP User Agent", QIDNAME(qid) AS EventName, starttime, endtime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Apache HTTP Server', 'F5 BIG-IP')
AND ("HTTP Response Code" IN ('200', '206', '301', '302'))
AND (
  URL MATCHES '(?i)/(storage|files|share|download|content)/'
  OR URL MATCHES '(?i)(\.\./|%2e%2e%2f|%252e%252e)'
  OR URL MATCHES '(?i)/(web\.config|appsettings\.json|\.ssh|etc/passwd|boot\.ini)'
)
AND NOT INCIDR(sourceip, '10.0.0.0/8')
AND NOT INCIDR(sourceip, '172.16.0.0/12')
AND NOT INCIDR(sourceip, '192.168.0.0/16')
LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=web/iis OR _sourceCategory=web/apache OR _sourceCategory=proxy
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+\S+\s+\S+\s+\[(?P<timestamp>[^\]]+)\]\s+\"(?P<method>\w+)\s+(?P<uri_path>\S+)\s+HTTP/[\d\.]+\"\s+(?P<status>\d{3})"
| where status in ("200", "206", "301", "302")
| where (uri_path matches /(?i)\/(storage|files|share|download|content)\//) or (uri_path matches /(?i)(\.\.[\/\\]|%2e%2e|%252e%252e)/) or (uri_path matches /(?i)\/(web\.config|appsettings|\.ssh|etc\/passwd)/)
| where !(src_ip matches /^10\./ or src_ip matches /^172\.(1[6-9]|2[0-9]|3[0-1])\./ or src_ip matches /^192\.168\./)
| timeslice 1h
| stats count as request_count, values(uri_path) as paths by _timeslice, src_ip, method, status
| where request_count > 3
| order by request_count desc

rule cve_2025_11371_gladinet_unauthorized_access {
  meta:
    author = "df00tech"
    description = "Detects CVE-2025-11371 - Gladinet CentreStack/Triofox unauthorized file/directory access by external parties"
    severity = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11371"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.response_code = /^(200|206|301|302)$/
    (
      $http.network.http.request_url = /(?i)\/(storage|files|share|download|content)\// or
      $http.network.http.request_url = /(?i)(\.\.[\/\\]|%2e%2e|%252e%252e)/ or
      $http.network.http.request_url = /(?i)\/(web\.config|appsettings|\.ssh|etc\/passwd)/
    )
    not $http.principal.ip = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/

  condition:
    $http
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| $falcon.metadata.eventType != "internal"
| RemotePort in [80, 443, 8080, 8443]
| HttpUrl = /(?i)\/(storage|files|share|download|content)\// OR HttpUrl = /(?i)(\.\.[\/\\]|%2e%2e|%252e%252e)/ OR HttpUrl = /(?i)\/(web\.config|appsettings|\.ssh|etc\/passwd)/
| HttpStatus in [200, 206, 301, 302]
| groupby([RemoteAddressIP4, HttpUrl, HttpStatus, HttpMethod, UserAgent], function=count(1, as=RequestCount))
| where RequestCount > 2
| sort(RequestCount, order=desc)