Kentico Xperience Path Traversal and Arbitrary File Upload (CVE-2025-2749)

let suspiciousExtensions = dynamic(['.aspx', '.asp', '.ashx', '.asmx', '.config', '.php', '.jsp', '.exe', '.dll', '.bat', '.cmd', '.ps1', '.sh']);
let kenticoUploadPaths = dynamic(['/kentico/', '/cmspages/', '/cmsformcontrols/', '/cmsmodules/', '/getfile/', '/uploadfile/']);
union DeviceNetworkEvents, W3CIISLog, AppServiceHTTPLogs
| where TimeGenerated >= ago(24h)
| where RequestUri has_any (kenticoUploadPaths)
| where RequestUri matches regex @"\.\.[\/\\]"
    or RequestUri has "%2e%2e"
    or RequestUri has "%252e"
    or RequestUri has "..%2f"
    or RequestUri has "..%5c"
| extend FileExt = extract(@"(\.[a-zA-Z0-9]{2,5})(?:\?|$)", 1, tolower(RequestUri))
| where FileExt in (suspiciousExtensions) or HttpMethod == "POST"
| project TimeGenerated, ClientIP, RequestUri, HttpMethod, HttpStatus, FileExt, UserAgent, SiteName
| order by TimeGenerated desc

index=web sourcetype IN ("iis", "ms:iis:auto", "access_combined")
| eval uri=lower(uri_path)
| where match(uri, "/kentico/") OR match(uri, "/cmspages/") OR match(uri, "/cmsformcontrols/") OR match(uri, "/cmsmodules/") OR match(uri, "/getfile/") OR match(uri, "/uploadfile/")
| where match(uri, "\.\./") OR match(uri, "\.\.%2f") OR match(uri, "%252e") OR match(uri, "\.\.%5c") OR match(uri, "%2e%2e")
| eval suspicious_ext=if(match(uri, "\.(aspx|asp|ashx|asmx|php|jsp|exe|dll|bat|cmd|ps1|sh|config)(\?|$)"), "true", "false")
| eval path_traversal="true"
| table _time, src_ip, uri, method, status, suspicious_ext, useragent, host
| sort -_time

sequence by host.name with maxspan=5m
  [network where event.category == "network" and http.request.method in ("POST", "PUT")
   and (
     url.path like "*/kentico/*" or
     url.path like "*/cmspages/*" or
     url.path like "*/cmsformcontrols/*" or
     url.path like "*/uploadfile/*"
   )
   and (
     url.path like "*../*" or
     url.path like "*%2e%2e*" or
     url.path like "*%252e*" or
     url.path like "*..%2f*"
   )
  ]
  [file where event.type in ("creation", "change")
   and file.extension in ("aspx", "asp", "ashx", "asmx", "php", "jsp", "exe", "dll", "config")
   and not file.path like "*\\Temp\\*"
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  "URL" AS request_url,
  "Method" AS http_method,
  "Response Code" AS http_status,
  "User Agent" AS user_agent,
  LOGSOURCENAME(logsourceid) AS log_source
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Apache HTTP Server')
  AND (LOWER("URL") LIKE '%/kentico/%'
    OR LOWER("URL") LIKE '%/cmspages/%'
    OR LOWER("URL") LIKE '%/cmsformcontrols/%'
    OR LOWER("URL") LIKE '%/uploadfile/%')
  AND (LOWER("URL") LIKE '%../%'
    OR LOWER("URL") LIKE '%..\\%'
    OR LOWER("URL") LIKE '%..%2f%'
    OR LOWER("URL") LIKE '%..%5c%'
    OR LOWER("URL") LIKE '%%252e%2e%')
  AND LOGSOURCETIME > NOW() - 1 HOURS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=iis* OR _sourceCategory=webserver*
| parse regex "(?<client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| parse regex "\"(?<method>GET|POST|PUT|DELETE|PATCH)\s+(?<uri>[^\s]+)" nodrop
| where matches(toLowerCase(uri), ".*(kentico|cmspages|cmsformcontrols|uploadfile).*")
| where matches(toLowerCase(uri), ".*(\.\./|%2e%2e|%252e|\.\.%2f|\.\.%5c).*")
| eval suspicious = if(matches(toLowerCase(uri), ".*\.(aspx|asp|ashx|php|jsp|exe|dll|config).*"), "high", "medium")
| count by client_ip, method, uri, suspicious
| where _count > 0
| sort by _count desc

rule cve_2025_2749_kentico_path_traversal {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects path traversal exploitation attempts against Kentico Xperience CMS (CVE-2025-2749)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-2749"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = /POST|PUT/
    (
      $e.network.http.target_url = /\/kentico\//i nocase or
      $e.network.http.target_url = /\/cmspages\//i nocase or
      $e.network.http.target_url = /\/cmsformcontrols\//i nocase or
      $e.network.http.target_url = /\/uploadfile\//i nocase
    )
    (
      $e.network.http.target_url = /\.\.\//i or
      $e.network.http.target_url = /%2e%2e/i or
      $e.network.http.target_url = /%252e/i or
      $e.network.http.target_url = /\.\.%2f/i or
      $e.network.http.target_url = /\.\.%5c/i
    )

  condition:
    $e
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=HttpRequest
| ImageFileName = /(?i)(w3wp|httpd|nginx)/
| HttpUrl = /(?i)(kentico|cmspages|cmsformcontrols|uploadfile)/
| HttpUrl = /(\.\.\/|%2e%2e|%252e|\.\. %2f|\.\.%5c)/
| HttpVerb IN ["POST", "PUT"]
| select([timestamp, HttpUrl, HttpVerb, RemoteIP, LocalIP, LocalPort, ImageFileName, TargetProcessId, UserName])
| sort(timestamp, order=desc)