CVE-2025-48703 - CWP Control Web Panel OS Command Injection

let cwp_processes = dynamic(['perl', 'python', 'python3', 'bash', 'sh', 'curl', 'wget', 'nc', 'ncat', 'socat']);
let cwp_web_paths = dynamic(['/usr/local/cwpsrv/', '/opt/cwp/', 'cwp_api', 'cwp-api']);
let suspicious_cmds = dynamic(['id', 'whoami', 'uname', 'cat /etc/passwd', 'cat /etc/shadow', 'chmod', 'chown', 'curl', 'wget', '/tmp/', '/dev/shm']);
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated > ago(24h)
| where (ParentProcessName has_any ('httpd', 'apache2', 'nginx', 'cwpsrv', 'php-fpm', 'php')
    and ProcessCommandLine has_any (suspicious_cmds))
    or (ProcessCommandLine has_any (cwp_web_paths) and ProcessCommandLine has_any (suspicious_cmds))
| extend RiskScore = case(
    ProcessCommandLine has_any (['cat /etc/shadow', 'chmod 777', '/dev/shm', 'base64']), 'Critical',
    ProcessCommandLine has_any (['wget', 'curl', 'nc ', 'ncat']), 'High',
    'Medium')
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ParentProcessName, InitiatingProcessCommandLine, RiskScore
| order by TimeGenerated desc

index=os OR index=web sourcetype=linux_audit OR sourcetype=syslog OR sourcetype=access_combined
| eval is_cwp_parent=if(match(parent_process, "httpd|apache2|nginx|cwpsrv|php-fpm|php"), 1, 0)
| eval is_suspicious_cmd=if(match(cmd, "id|whoami|uname|passwd|shadow|chmod|wget|curl|nc |ncat|socat|base64|/tmp/|/dev/shm"), 1, 0)
| eval is_cwp_path=if(match(_raw, "/usr/local/cwpsrv/|/opt/cwp/|cwp_api"), 1, 0)
| where (is_cwp_parent=1 AND is_suspicious_cmd=1) OR (is_cwp_path=1 AND is_suspicious_cmd=1)
| eval risk=case(
    match(cmd, "shadow|/dev/shm|base64|chmod 777"), "critical",
    match(cmd, "wget|curl|nc |ncat"), "high",
    true(), "medium")
| stats count, values(cmd) as commands, values(src_ip) as source_ips, earliest(_time) as first_seen, latest(_time) as last_seen by host, user, parent_process, risk
| where count > 0
| sort -risk, -count

sequence by host.name with maxspan=30s
  [process where event.type == "start"
    and process.parent.name : ("httpd", "apache2", "nginx", "cwpsrv", "php", "php-fpm")
    and process.name : ("bash", "sh", "dash", "perl", "python*", "ruby", "curl", "wget", "nc", "ncat", "socat")]
  [process where event.type == "start"
    and process.command_line : ("*id*", "*whoami*", "*passwd*", "*shadow*", "*/tmp/*", "*/dev/shm*", "*base64*", "*wget*", "*curl*")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as event_time,
  sourceip,
  username,
  "hostname",
  "Process Name" as process_name,
  "Command" as command_line,
  CATEGORY
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Linux', 'Syslog', 'Apache HTTP Server')
  AND (
    ("Parent Process" ILIKE '%httpd%' OR "Parent Process" ILIKE '%cwpsrv%' OR "Parent Process" ILIKE '%php%' OR "Parent Process" ILIKE '%nginx%')
    AND ("Command" ILIKE '%id%' OR "Command" ILIKE '%whoami%' OR "Command" ILIKE '%/etc/passwd%' OR "Command" ILIKE '%/etc/shadow%'
         OR "Command" ILIKE '%wget%' OR "Command" ILIKE '%curl%' OR "Command" ILIKE '%/tmp/%' OR "Command" ILIKE '%base64%')
  )
  AND starttime > NOW() - 24 HOURS
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=linux/audit OR _sourceCategory=web/access
| parse regex "(?<parent_proc>httpd|apache2|nginx|cwpsrv|php-fpm|php)" nodrop
| parse regex field=_raw "(?<suspicious_cmd>id\b|whoami|/etc/passwd|/etc/shadow|/tmp/[\w]+|/dev/shm|base64|wget\s|curl\s|nc\s|ncat\s|socat)" nodrop
| where !isNull(parent_proc) AND !isNull(suspicious_cmd)
| parse regex field=_raw "user=(?<exec_user>[^\s]+)" nodrop
| parse regex field=_raw "pid=(?<pid>\d+)" nodrop
| eval risk = if(suspicious_cmd matches "/etc/shadow|/dev/shm|base64", "critical",
    if(suspicious_cmd matches "wget|curl|nc |ncat", "high", "medium"))
| count by _sourceHost, exec_user, parent_proc, suspicious_cmd, risk
| sort by risk, _count desc

rule cwp_os_command_injection_cve_2025_48703 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects OS command injection exploitation in CWP Control Web Panel (CVE-2025-48703)"
    severity = "CRITICAL"
    priority = "HIGH"
    mitre_attack_tactic = "Execution, Initial Access"
    mitre_attack_technique = "T1190, T1059"
    cve = "CVE-2025-48703"

  events:
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.parent_process.file.full_path = /httpd|apache2|nginx|cwpsrv|php-fpm|php/
    (
      $proc.target.process.file.full_path = /\/bin\/bash|\/bin\/sh|\/usr\/bin\/perl|\/usr\/bin\/python/ or
      $proc.target.process.command_line = /id\b|whoami|passwd|shadow|\/tmp\/|\/dev\/shm|base64|wget|curl|\bnc\b|ncat|socat/
    )

  condition:
    $proc
}

DeviceProcessEvents
| filter event_platform = "Lin"
| filter (
    ParentBaseFileName in ("httpd", "apache2", "nginx", "cwpsrv", "php", "php-fpm")
    and (
      FileName in ("bash", "sh", "dash", "perl", "python3", "python", "curl", "wget", "nc", "ncat", "socat")
      or CommandLine matches regex "(?i)(id\b|whoami|/etc/passwd|/etc/shadow|/tmp/[^\s]+|/dev/shm|base64|chmod\s+[0-9]|chown\s)"
    )
  )
| eval RiskLevel = case(
    CommandLine matches regex "(?i)(/etc/shadow|/dev/shm|base64 -d|reverse shell)", "Critical",
    CommandLine matches regex "(?i)(wget|curl|nc |ncat|socat)", "High",
    1=1, "Medium")
| select timestamp, DeviceHostName, UserName, ParentBaseFileName, FileName, CommandLine, RiskLevel
| sort timestamp desc
| limit 500