CVE-2025-2746: Kentico Xperience CMS Authentication Bypass

union DeviceNetworkEvents, W3CIISLog
| where TimeGenerated >= ago(7d)
| where (
    (csUriStem has_any ("/CMSPages/", "/CMSModules/", "/CMSAdminControls/", "/CMS/", "/Admin/"))
    or (RequestUri has_any ("/CMSPages/", "/CMSModules/", "/CMSAdminControls/", "/CMS/", "/Admin/"))
  )
| where (
    (scStatus in (200, 201, 302) and csUriStem has_any ("login", "logon", "signin", "auth") == false)
    or (csUriStem matches regex @"(?i)(/\.\./|%2e%2e|%252e%252e|/admin(?!.*login))")  
  )
| where (csUsername == "-" or csUsername == "" or isnull(csUsername))
| summarize
    RequestCount = count(),
    DistinctURIs = dcount(csUriStem),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    URISamples = make_set(csUriStem, 10),
    UserAgents = make_set(csUserAgent, 5)
    by csClientIP, csHost, bin(TimeGenerated, 5m)
| where RequestCount >= 3
| extend AlertSeverity = iff(DistinctURIs >= 5, "High", "Medium")
| project FirstSeen, LastSeen, csClientIP, csHost, RequestCount, DistinctURIs, URISamples, UserAgents, AlertSeverity

index=web OR index=iis sourcetype=iis OR sourcetype=ms:iis:auto
| eval uri=coalesce(cs_uri_stem, uri_path, url)
| eval status=coalesce(sc_status, status, http_status_code)
| eval src_ip=coalesce(c_ip, src_ip, clientip)
| eval username=coalesce(cs_username, user, username)
| where match(uri, "(?i)(/CMSPages/|/CMSModules/|/CMSAdminControls/|/CMS/|/Admin/)")
| where status IN ("200", "201", "302", "301")
| where (isnull(username) OR username="-" OR username="")
| where NOT match(uri, "(?i)(login|logon|signin|forgot|reset)")
| bucket _time span=5m
| stats
    count AS request_count,
    dc(uri) AS distinct_uris,
    values(uri) AS uri_samples,
    values(cs_user_agent) AS user_agents,
    min(_time) AS first_seen,
    max(_time) AS last_seen
    BY _time, src_ip, cs_host
| where request_count >= 3
| eval severity=if(distinct_uris>=5, "high", "medium")
| eval cve="CVE-2025-2746"
| table first_seen, last_seen, src_ip, cs_host, request_count, distinct_uris, uri_samples, user_agents, severity, cve

sequence by source.ip with maxspan=5m
  [network where event.dataset in ("iis.access", "apache.access", "nginx.access")
   and url.path : ("/CMSPages/*", "/CMSModules/*", "/CMSAdminControls/*", "/CMS/*", "/Admin/*")
   and http.response.status_code in (200, 201, 302)
   and (not exists(user.name) or user.name in ("-", "", "anonymous"))
   and not url.path : ("*login*", "*logon*", "*signin*")]
  [network where event.dataset in ("iis.access", "apache.access", "nginx.access")
   and url.path : ("/CMSPages/*", "/CMSModules/*", "/CMSAdminControls/*", "/CMS/*", "/Admin/*")
   and http.response.status_code in (200, 201, 302)
   and (not exists(user.name) or user.name in ("-", "", "anonymous"))]
  [network where event.dataset in ("iis.access", "apache.access", "nginx.access")
   and url.path : ("/CMSPages/*", "/CMSModules/*", "/CMSAdminControls/*", "/CMS/*", "/Admin/*")
   and http.response.status_code in (200, 201, 302)
   and (not exists(user.name) or user.name in ("-", "", "anonymous"))]

SELECT
  sourceip,
  "URL" AS request_uri,
  "HTTP Response Code" AS http_status,
  "Username" AS auth_user,
  COUNT(*) AS request_count,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Apache HTTP Server', 'Nginx')
  AND ("URL" IMATCHES '.*/(CMSPages|CMSModules|CMSAdminControls|CMS|Admin)/.*')
  AND "HTTP Response Code" IN ('200', '201', '302')
  AND ("Username" IS NULL OR "Username" IN ('-', '', 'anonymous'))
  AND "URL" NOT IMATCHES '.*(login|logon|signin|auth).*'
  AND DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm') >= DATEFORMAT(NOW() - 604800000, 'YYYY-MM-dd HH:mm')
GROUP BY sourceip, "URL", "HTTP Response Code", "Username"
HAVING COUNT(*) >= 3
ORDER BY request_count DESC
LAST 7 DAYS

_sourceCategory=iis OR _sourceCategory=webserver
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) .* (?P<method>GET|POST|PUT|DELETE|PATCH) (?P<uri>/[^ ]*) .* (?P<status>\d{3}) .* (?P<username>[^ ]+)"
| where uri matches "/CMSPages/*" OR uri matches "/CMSModules/*" OR uri matches "/CMSAdminControls/*" OR uri matches "/CMS/*" OR uri matches "/Admin/*"
| where status in ("200", "201", "302")
| where username in ("-", "", "anonymous") OR isNull(username)
| where !(uri matches "*login*" OR uri matches "*logon*" OR uri matches "*signin*")
| timeslice 5m
| stats count as request_count, dcount(uri) as distinct_uris, values(uri) as uri_list by src_ip, _timeslice
| where request_count >= 3
| sort by request_count desc
| fields src_ip, _timeslice, request_count, distinct_uris, uri_list

rule cve_2025_2746_kentico_auth_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects authentication bypass exploitation of CVE-2025-2746 in Kentico Xperience CMS via unauthenticated access to protected CMS paths"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-2746"
    cve = "CVE-2025-2746"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1190"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.response_code in (200, 201, 302)
    (
      re.regex($e.network.http.request_url, `/CMSPages/|/CMSModules/|/CMSAdminControls/|/CMS/|/Admin/`)
    )
    not re.regex($e.network.http.request_url, `(?i)(login|logon|signin|auth|forgot)`)
    (
      not $e.principal.user.userid != ""
      or $e.principal.user.userid = "-"
      or $e.principal.user.userid = "anonymous"
    )

  match:
    $e.principal.ip over 5m

  condition:
    #e >= 3
}

#event_simpleName=NetworkReceiveAccepted OR #event_simpleName=NetworkConnectIP4
| search RemotePort=80 OR RemotePort=443 OR RemotePort=8080
| search ContextImageFileName=/w3wp.exe/ OR ParentImageFileName=/w3wp.exe/
| join type=inner
  [
    event_platform=Win
    #event_simpleName=ProcessRollup2
    | search ImageFileName=/w3wp.exe/
    | stats count() by aid, TargetProcessId, CommandLine
  ]
  field=aid
| rename RemoteAddressIP4 as attacker_ip, TargetProcessId as iis_pid
| eval cms_indicator=if(CommandLine matches "/Kentico/" OR CommandLine matches "/CMS/" OR CommandLine matches "/CMSPages/", "true", "false")
| where cms_indicator="true"
| stats
    count() as connection_count,
    values(attacker_ip) as source_ips,
    min(timestamp) as first_seen,
    max(timestamp) as last_seen
    by aid, iis_pid, CommandLine
| where connection_count >= 5
| eval alert_name="CVE-2025-2746 Kentico Auth Bypass - IIS Process Anomaly"
| table first_seen, last_seen, aid, iis_pid, CommandLine, source_ips, connection_count, alert_name