CVE-2025-32432: Craft CMS Remote Code Injection

union isfuzzy=true
(
  W3CIISLog
  | where csUriStem has_any ("/actions/", "/index.php", "/admin/") and csMethod == "POST"
  | where csUriQuery has_any ("phpinfo", "base64_decode", "eval(", "system(", "exec(", "passthru(", "shell_exec(", "assert(", "preg_replace")
  | project TimeGenerated, Computer, csClientIP = cIP, csUriStem, csUriQuery, csUserAgent = csUserAgent, scStatus
),
(
  AzureDiagnostics
  | where Category == "AppServiceHTTPLogs"
  | where requestUri_s has_any ("/actions/", "/admin/")
  | where httpMethod_s == "POST"
  | where userAgent_s !has "Googlebot" and userAgent_s !has "Bingbot"
  | where originalRequestUriWithArgs_s has_any ("phpinfo", "eval(", "base64_decode", "system(", "exec(", "assert(")
  | project TimeGenerated, Resource, clientIP_s, requestUri_s, originalRequestUriWithArgs_s, httpMethod_s, httpStatusCode_d
),
(
  CommonSecurityLog
  | where DeviceVendor has_any ("F5", "Palo Alto Networks", "Fortinet", "Imperva")
  | where RequestURL has_any ("/actions/", "/admin/", "/index.php")
  | where Message has_any ("phpinfo", "eval(", "base64_decode", "system(", "exec(", "assert(", "code_injection", "CVE-2025-32432")
  | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, RequestURL, Message
)
| where TimeGenerated > ago(24h)

index=web OR index=proxy OR index=waf
(sourcetype=iis OR sourcetype=apache:access OR sourcetype=nginx:plus:kv OR sourcetype=pan:traffic OR sourcetype=suricata)
(uri_path="*/actions/*" OR uri_path="*/admin/*" OR uri_path="*/index.php*")
method=POST
(uri_query="*phpinfo*" OR uri_query="*base64_decode*" OR uri_query="*eval(*" OR uri_query="*system(*" OR uri_query="*exec(*" OR uri_query="*assert(*" OR uri_query="*passthru(*" OR uri_query="*shell_exec(*" OR request_body="*phpinfo*" OR request_body="*base64_decode*" OR request_body="*eval(*")
| eval severity="critical", cve="CVE-2025-32432"
| stats count, values(uri_path) as paths, values(uri_query) as queries, earliest(_time) as first_seen, latest(_time) as last_seen by src_ip, dest, http_user_agent
| where count > 0
| sort -count

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and http.request.method == "POST"
   and (url.path : "*/actions/*" or url.path : "*/admin/*" or url.path : "*/index.php*")
   and (
     url.query : "*phpinfo*" or url.query : "*base64_decode*" or url.query : "*eval(*"
     or url.query : "*system(*" or url.query : "*exec(*" or url.query : "*assert(*"
     or http.request.body.content : "*phpinfo*" or http.request.body.content : "*eval(*"
     or http.request.body.content : "*base64_decode*"
   )
  ]
  [process where event.category == "process" and event.type == "start"
   and process.parent.name in ("php", "php-fpm", "apache2", "httpd", "nginx")
   and process.name in ("sh", "bash", "python", "python3", "curl", "wget", "nc", "ncat")
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  URL,
  username,
  "HTTP Method",
  "HTTP Response Code",
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) IN ('IBM Security Network IPS (GV2)', 'Apache HTTP Server', 'Microsoft IIS', 'NGINX')
  AND (URL ILIKE '%/actions/%' OR URL ILIKE '%/admin/%' OR URL ILIKE '%/index.php%')
  AND "HTTP Method" = 'POST'
  AND (
    URL ILIKE '%phpinfo%'
    OR URL ILIKE '%base64_decode%'
    OR URL ILIKE '%eval(%'
    OR URL ILIKE '%system(%'
    OR URL ILIKE '%exec(%'
    OR URL ILIKE '%assert(%'
    OR URL ILIKE '%shell_exec(%'
    OR "HTTP Post Data" ILIKE '%phpinfo%'
    OR "HTTP Post Data" ILIKE '%eval(%'
    OR "HTTP Post Data" ILIKE '%base64_decode%'
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=web/access OR _sourceCategory=waf OR _sourceCategory=proxy
| where (_raw matches /\/actions\/|\/admin\/|\/index\.php/ and _raw matches /POST/)
| where _raw matches /phpinfo|base64_decode|eval\(|system\(|exec\(|assert\(|passthru\(|shell_exec\(/
| parse regex "(?<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" 
| parse regex "\"(?<http_method>GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS) (?<uri_path>[^ ]+)"
| parse regex "HTTP\/[\\d\.]+\" (?<status_code>\\d{3})"
| count by src_ip, uri_path, status_code
| where _count > 0
| sort by _count desc
| fields src_ip, uri_path, status_code, _count
| rename _count as request_count

rule craft_cms_cve_2025_32432_code_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-32432 Craft CMS code injection exploitation attempts"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2025-32432"
    mitre_attack = "T1190, T1059, T1505.003"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = "POST"
    (
      re.regex($http.network.http.request_url, `(?i)/actions/|/admin/|/index\.php`)
    )
    (
      re.regex($http.network.http.request_url, `(?i)phpinfo|base64_decode|eval\(|system\(|exec\(|assert\(|passthru\(|shell_exec\(`)
      or re.regex($http.network.http.request_body, `(?i)phpinfo|base64_decode|eval\(|system\(|exec\(|assert\(`)
    )

  condition:
    $http
}

#event_simpleName=NetworkReceiveAcceptIP4 OR #event_simpleName=NetworkReceiveAcceptIP6
| TargetPort IN (80, 443, 8080, 8443)
| ImageFileName CONTAINS "php"
| CommandLine MATCHES "(?i)(phpinfo|base64_decode|eval\(|system\(|exec\(|assert\(|passthru\(|shell_exec\()"
| groupBy([aid, ComputerName, LocalAddressIP4, RemoteAddressIP4, TargetPort, CommandLine], function=count())
| sort(count, order=desc)

// Companion process-level detection
// #event_simpleName=ProcessRollup2
// | ParentBaseFileName IN ("php", "php-fpm", "php8.1", "php8.2", "apache2", "httpd", "nginx")
// | FileName IN ("sh", "bash", "dash", "python3", "python", "curl", "wget", "nc", "perl")
// | CommandLine NOT MATCHES "(?i)(composer|artisan|phpunit|codecept)"
// | groupBy([aid, ComputerName, ParentBaseFileName, FileName, CommandLine], function=count())