CVE-2025-40602 - SonicWall SMA1000 Missing Authorization Exploitation

union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated > ago(24h)
| where (DeviceVendor has "SonicWall" or DeviceProduct has "SMA1000" or DestinationPort in (443, 8443, 80, 8080))
| where (RequestURL has_any ("/appliance/", "/management", "/api/", "/admin", "/auth", "/vpn") or Message has_any ("/appliance/", "/management"))
| where (ResultCode in ("200", "201", "204") and RequestURL has_any ("/admin", "/management", "/config", "/api/v1"))
    or (ResultCode in ("401", "403") and RequestURL has_any ("/admin", "/management") and isnotempty(SourceIP))
| summarize RequestCount = count(), DistinctURLs = dcount(RequestURL), DistinctStatusCodes = dcount(ResultCode), RequestURLs = make_set(RequestURL, 20), StatusCodes = make_set(ResultCode) by SourceIP = coalesce(SourceIP, RemoteIP), DestinationIP = coalesce(DestinationIP, LocalIP), bin(TimeGenerated, 5m)
| where RequestCount >= 5 or DistinctURLs >= 3
| extend RiskScore = case(
    RequestCount >= 20 and DistinctURLs >= 5, "High",
    RequestCount >= 10, "Medium",
    "Low")
| project TimeGenerated, SourceIP, DestinationIP, RequestCount, DistinctURLs, RequestURLs, StatusCodes, RiskScore

index=network sourcetype IN ("sonicwall", "sonicwall:sma", "cisco:asa", "pan:traffic", "firewall")
| where dest_port IN ("443", "8443", "80", "8080")
| eval is_sma_path=if(match(uri_path, "(?i)/(appliance|management|admin|api|vpn|config)"), 1, 0)
| where is_sma_path=1
| eval is_success=if(status IN ("200","201","204"), 1, 0)
| eval is_auth_bypass=if(status IN ("200","201") AND match(uri_path, "(?i)/(admin|management|config|api)"), 1, 0)
| stats count AS total_requests, sum(is_success) AS successful_requests, sum(is_auth_bypass) AS potential_bypasses, dc(uri_path) AS distinct_paths, values(uri_path) AS paths_accessed, values(status) AS status_codes BY src_ip, dest_ip, _time span=5m
| where total_requests >= 5 OR potential_bypasses >= 1
| eval risk_score=case(potential_bypasses >= 3 AND distinct_paths >= 5, "HIGH", potential_bypasses >= 1 AND distinct_paths >= 2, "MEDIUM", 1=1, "LOW")
| table _time, src_ip, dest_ip, total_requests, successful_requests, potential_bypasses, distinct_paths, paths_accessed, status_codes, risk_score
| sort - potential_bypasses, total_requests

sequence by source.ip with maxspan=10m
  [network where network.protocol == "http" and destination.port in (443, 8443, 80, 8080)
   and url.path : ("/appliance/*", "/management*", "/admin*", "/api/*", "/vpn*", "/config*")
   and http.response.status_code in (401, 403)]
  [network where network.protocol == "http" and destination.port in (443, 8443, 80, 8080)
   and url.path : ("/appliance/*", "/management*", "/admin*", "/api/*", "/vpn*", "/config*")
   and http.response.status_code in (200, 201, 204)]

SELECT sourceip, destinationip, destinationport, URL, Method, responseCode, categoryname, RULENAME, UTF8(payload) as payload_text, starttime, endtime, eventcount
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%sonicwall%'
   OR LOGSOURCETYPENAME(devicetype) ILIKE '%firewall%'
   OR (destinationport IN (443, 8443, 80, 8080)
       AND (URL ILIKE '%/appliance/%'
            OR URL ILIKE '%/management%'
            OR URL ILIKE '%/admin%'
            OR URL ILIKE '%/api/%'
            OR URL ILIKE '%/vpn%'
            OR URL ILIKE '%/config%'))
AND (responseCode IN ('200','201','204') AND (URL ILIKE '%/admin%' OR URL ILIKE '%/management%' OR URL ILIKE '%/api%'))
GROUP BY sourceip, destinationip, destinationport, URL, responseCode
HAVING eventcount >= 3
LAST 24 HOURS
ORDER BY eventcount DESC

_sourceCategory=network/firewall OR _sourceCategory=sonicwall/sma
| where !(isNull(dest_port)) and dest_port in ("443","8443","80","8080")
| where uri_path matches "*appliance*" or uri_path matches "*management*" or uri_path matches "*/admin*" or uri_path matches "*/api/*" or uri_path matches "*/vpn*" or uri_path matches "*/config*"
| where status_code in ("200","201","204")
| timeslice 5m
| stats count as request_count, dcount(uri_path) as distinct_paths, values(uri_path) as accessed_paths, values(status_code) as status_codes by src_ip, dest_ip, _timeslice
| where request_count >= 3
| sort by request_count desc
| fields _timeslice, src_ip, dest_ip, request_count, distinct_paths, accessed_paths, status_codes

rule cve_2025_40602_sonicwall_sma1000_missing_authz {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-40602 SonicWall SMA1000 missing authorization exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0019"

  events:
    $req.metadata.event_type = "NETWORK_HTTP"
    $req.target.port in (443, 8443, 80, 8080)
    (
      re.regex($req.target.url, `(?i)/(appliance|management|admin|api|vpn|config)`)
    )
    $req.network.http.response_code in (200, 201, 204)
    re.regex($req.target.url, `(?i)/(admin|management|config|api/v[0-9])`)
    $req.principal.ip != ""

  match:
    $req.principal.ip over 5m

  outcome:
    $risk_score = max(
      if($req.network.http.response_code = 200 and re.regex($req.target.url, `(?i)/(admin|management)`), 80, 40)
    )
    $src_ip = array_distinct($req.principal.ip)
    $urls_accessed = array_distinct($req.target.url)

  condition:
    #req >= 3
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkReceiveAcceptIP4
| DestinationPort in (443, 8443, 80, 8080)
| LocalAddressIP4 != null
| join type=inner (
    #event_simpleName=ProcessRollup2
    | ImageFileName=/sonicwall|sma1000|appliance/i
    | select aid, ContextProcessId, ImageFileName, CommandLine
  ) [aid, ContextProcessId]
| select timestamp, aid, LocalAddressIP4, RemoteAddressIP4, DestinationPort, ImageFileName, CommandLine
| groupby([RemoteAddressIP4, LocalAddressIP4], function=[count(as=conn_count), collect([DestinationPort, CommandLine])])
| conn_count >= 5
| sort -conn_count