Kentico Xperience CMS Authentication Bypass (CVE-2025-2747)

union isfuzzy=true
(
  W3CIISLog
  | where csUriStem has_any ("/CMSPages/", "/CMSModules/", "/Admin/", "/KenticoCMS/", "/cms/", "/CMS/", "/cmspages/")
  | where csUriStem has_any ("GetResource", "CMSFormControls", "GetDoc", "CMSDesk", "sitemanager", "SiteManager")
  | where scStatus in (200, 201, 302) and csUsername in ("", "-", "anonymous")
  | project TimeGenerated, Computer, csClientIP=c_ip, csMethod=cs_method, csUriStem=cs_uri_stem, csUriQuery=cs_uri_query, scStatus=sc_status, scBytes=sc_bytes, csUsername=cs_username, csUserAgent=cs_user_agent
),
(
  AzureDiagnostics
  | where Category == "ApplicationGatewayAccessLog"
  | where requestUri_s has_any ("/CMSPages/", "/CMSModules/", "/Admin/", "/KenticoCMS/")
  | where httpStatus_d in (200, 201, 302)
  | project TimeGenerated, clientIP_s, requestUri_s, httpStatus_d, userAgent_s, host_s
)
| where TimeGenerated >= ago(1d)

index=web sourcetype IN ("iis", "access_combined", "nginx:plus:kv") 
| where uri_path IN ["/CMSPages/", "/CMSModules/", "/Admin/", "/KenticoCMS/", "/CMS/", "/cms/"] OR like(uri_path, "%CMSPages%") OR like(uri_path, "%CMSModules%") OR like(uri_path, "%SiteManager%") OR like(uri_path, "%CMSDesk%")
| where status IN ("200", "201", "302")
| where cs_username IN ("-", "", "anonymous") OR isnull(cs_username)
| eval is_admin_path=if(like(uri_path, "%SiteManager%") OR like(uri_path, "%CMSDesk%") OR like(uri_path, "%Admin%"), 1, 0)
| stats count AS request_count, values(uri_path) AS accessed_paths, values(status) AS statuses, dc(uri_path) AS distinct_paths BY src_ip, cs_username, is_admin_path
| where request_count > 1
| sort -is_admin_path, -request_count

sequence by source.ip with maxspan=5m
  [network where event.dataset == "iis.access" and
   url.path : ("/CMSPages/*", "/CMSModules/*", "/Admin/*", "/KenticoCMS/*", "/CMS/SiteManager/*", "/CMS/CMSDesk/*") and
   http.response.status_code in (200, 201, 302) and
   (user.name == "-" or user.name == "" or user.name == "anonymous" or user.name == null)]
  [network where event.dataset == "iis.access" and
   url.path : ("/CMSPages/*", "/CMSModules/*", "/Admin/*") and
   http.response.status_code in (200, 201, 302)]

SELECT sourceip, URL, username, statuscode, QIDNAME(qid) AS eventname, starttime, "devicetime"
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) IN ('Microsoft IIS', 'Apache HTTP Server', 'Nginx')
  AND (URL ILIKE '%/CMSPages/%' OR URL ILIKE '%/CMSModules/%' OR URL ILIKE '%/Admin/%' OR URL ILIKE '%/KenticoCMS/%' OR URL ILIKE '%/CMS/SiteManager%' OR URL ILIKE '%/CMSDesk%')
  AND statuscode IN ('200', '201', '302')
  AND (username IS NULL OR username = '' OR username = '-' OR LOWER(username) = 'anonymous')
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=web/iis OR _sourceCategory=web/nginx OR _sourceCategory=web/apache
| parse "* * * * * * *" as datetime, src_ip, cs_username, method, uri_stem, status, bytes nodrop
| where uri_stem matches "/CMSPages/*" or uri_stem matches "/CMSModules/*" or uri_stem matches "/Admin/*" or uri_stem matches "/KenticoCMS/*" or uri_stem matches "*/SiteManager*" or uri_stem matches "*/CMSDesk*"
| where status in ("200","201","302")
| where cs_username = "-" or cs_username = "" or cs_username = "anonymous"
| count by src_ip, uri_stem, status
| sort by _count desc

rule kentico_xperience_auth_bypass_cve_2025_2747 {
  meta:
    author = "df00tech"
    description = "Detects unauthenticated access to Kentico Xperience CMS administrative paths - CVE-2025-2747"
    severity = "CRITICAL"
    yara_version = "YL2.0"
    rule_version = "1.0"
  events:
    $req.metadata.event_type = "NETWORK_HTTP"
    $req.network.http.response_code in (200, 201, 302)
    (
      re.regex($req.target.url, `(?i)/CMSPages/`) or
      re.regex($req.target.url, `(?i)/CMSModules/`) or
      re.regex($req.target.url, `(?i)/Admin/`) or
      re.regex($req.target.url, `(?i)/KenticoCMS/`) or
      re.regex($req.target.url, `(?i)/CMS/SiteManager`) or
      re.regex($req.target.url, `(?i)/CMSDesk`)
    )
    not re.regex($req.principal.user.userid, `^[a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}$`)
  condition:
    $req
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkConnectIP6
| EventType = "NetworkConnect"
| RemotePort in (80, 443, 8080, 8443)
| LocalAddressIP4 != null
| join { #event_simpleName=ProcessRollup2
  | ImageFileName matches regex "(?i)(w3wp\.exe|httpd\.exe|nginx\.exe|iisexpress\.exe)"
  | CommandLine matches regex "(?i)(kentico|xperience|cms)"
} [LocalProcessId, ContextProcessId]
| select timestamp, ComputerName, UserName, ImageFileName, CommandLine, RemoteAddressIP4, RemotePort