Adobe Commerce / Magento Improper Input Validation (CVE-2025-54236)

let MagentoEndpoints = dynamic(['/rest/', '/api/', '/index.php/rest/', '/pub/index.php', '/graphql', '/downloader/', '/admin/']);
let SuspiciousPatterns = dynamic(['eval(', 'base64_decode', 'system(', 'exec(', 'passthru(', 'shell_exec', 'phpinfo', '<?php', 'assert(', 'preg_replace']);
union
(
    W3CIISLog
    | where csUriStem has_any (MagentoEndpoints)
    | where csMethod in ('POST', 'PUT', 'PATCH')
    | where scStatus in (200, 201, 500)
    | where csUriQuery has_any (SuspiciousPatterns) or csBytes > 50000
    | extend RequestPath = strcat(csUriStem, '?', csUriQuery)
),
(
    AzureDiagnostics
    | where Category == 'ApplicationGatewayAccessLog'
    | where requestUri_s has_any (MagentoEndpoints)
    | where httpMethod_s in ('POST', 'PUT', 'PATCH')
    | where httpStatus_d in (200, 500)
    | extend RequestPath = requestUri_s
),
(
    CommonSecurityLog
    | where DeviceVendor in ('Apache', 'nginx', 'F5', 'Imperva')
    | where RequestURL has_any (MagentoEndpoints)
    | where RequestMethod in ('POST', 'PUT', 'PATCH')
    | extend RequestPath = RequestURL
)
| summarize RequestCount=count(), UniqueIPs=dcount(cIP), Paths=make_set(RequestPath, 20) by bin(TimeGenerated, 5m), cIP
| where RequestCount > 10 or UniqueIPs > 5
| extend AlertSeverity = iff(RequestCount > 50 or UniqueIPs > 20, 'Critical', 'High')
| project TimeGenerated, SourceIP=cIP, RequestCount, UniqueIPs, SuspiciousPaths=Paths, AlertSeverity

index=web OR index=iis OR index=apache OR index=nginx
(uri_path="*/rest/*" OR uri_path="*/graphql" OR uri_path="*/index.php/rest/*" OR uri_path="*/admin/*" OR uri_path="*/downloader/*")
(method="POST" OR method="PUT" OR method="PATCH")
| eval is_suspicious_payload=if(match(uri_query, "(eval\(|base64_decode|system\(|exec\(|passthru|shell_exec|phpinfo|\<\?php|assert\()"), 1, 0)
| eval is_large_payload=if(bytes_in > 50000, 1, 0)
| eval is_error_response=if(status=500 OR status=502 OR status=503, 1, 0)
| stats count AS request_count,
        dc(src_ip) AS unique_src_ips,
        dc(uri_path) AS unique_paths,
        sum(is_suspicious_payload) AS suspicious_payload_count,
        sum(is_large_payload) AS large_payload_count,
        sum(is_error_response) AS error_response_count,
        values(uri_path) AS paths,
        values(status) AS status_codes
        BY _time span=5m, src_ip
| where request_count > 5 OR suspicious_payload_count > 0 OR large_payload_count > 2
| eval risk_score=case(
    suspicious_payload_count > 0, 90,
    large_payload_count > 5 AND error_response_count > 2, 75,
    request_count > 50, 60,
    1=1, 40
  )
| eval severity=case(risk_score >= 80, "critical", risk_score >= 60, "high", risk_score >= 40, "medium", 1=1, "low")
| where risk_score >= 40
| sort - risk_score
| table _time, src_ip, request_count, unique_src_ips, suspicious_payload_count, large_payload_count, error_response_count, paths, status_codes, risk_score, severity

sequence by source.ip with maxspan=2m
  [network where event.category == "network" and
   http.request.method in ("POST", "PUT", "PATCH") and
   (
     url.path like~ "*/rest/*" or
     url.path like~ "*/graphql*" or
     url.path like~ "*/index.php/rest/*" or
     url.path like~ "*/admin/index.php*" or
     url.path like~ "*/downloader/*"
   ) and
   http.response.status_code in (200, 500, 403)
  ] with runs=3
  [process where event.category == "process" and
   event.type == "start" and
   process.parent.name in ("php", "php-fpm", "httpd", "nginx", "apache2") and
   process.name in ("sh", "bash", "cmd.exe", "powershell.exe", "wget", "curl", "python", "python3")
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  URL,
  Method,
  "HTTP Response Code" AS response_code,
  "Bytes Sent" AS bytes_sent,
  COUNT(*) AS request_count
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Apache HTTP Server', 'NGINX', 'F5 BIG-IP')
  AND (
    URL ILIKE '%/rest/%'
    OR URL ILIKE '%/graphql%'
    OR URL ILIKE '%/index.php/rest/%'
    OR URL ILIKE '%/admin/index.php%'
    OR URL ILIKE '%/downloader/%'
  )
  AND Method IN ('POST', 'PUT', 'PATCH')
  AND LAST 24 HOURS
GROUP BY
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm'),
  sourceip,
  destinationip,
  URL,
  Method,
  "HTTP Response Code",
  "Bytes Sent"
HAVING
  COUNT(*) > 5
  OR "Bytes Sent" > 50000
ORDER BY request_count DESC

_sourceCategory=web/access OR _sourceCategory=iis OR _sourceCategory=apache
| parse regex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| parse regex "\"(?<method>GET|POST|PUT|PATCH|DELETE)\s+(?<uri_path>[^\s]+)" nodrop
| parse regex "\s(?<status_code>\d{3})\s" nodrop
| parse regex "\s(?<bytes>\d+)$" nodrop
| where method in ("POST", "PUT", "PATCH")
| where uri_path matches "*/rest/*" or uri_path matches "*/graphql*" or uri_path matches "*/index.php/rest/*" or uri_path matches "*/admin/*" or uri_path matches "*/downloader/*"
| timeslice 5m
| count as request_count, pct(bytes, 95) as p95_bytes by _timeslice, src_ip, uri_path
| where request_count > 5 or p95_bytes > 50000
| sort by request_count desc
| fields _timeslice, src_ip, uri_path, request_count, p95_bytes

rule cve_2025_54236_adobe_commerce_input_validation {
  meta:
    author = "Argus Detection Platform"
    description = "Detects potential exploitation of CVE-2025-54236 in Adobe Commerce/Magento via suspicious API requests"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-54236"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = /POST|PUT|PATCH/
    (
      $e.network.http.target_url = /\/rest\// or
      $e.network.http.target_url = /\/graphql/ or
      $e.network.http.target_url = /\/index\.php\/rest\// or
      $e.network.http.target_url = /\/admin\/index\.php/ or
      $e.network.http.target_url = /\/downloader\//
    )
    (
      $e.network.http.response_code = 200 or
      $e.network.http.response_code = 500
    )
    $e.principal.ip = $src_ip

  match:
    $src_ip over 5m

  condition:
    #e > 10
}

#event_simpleName=NetworkReceiveAcceptIP4
| ProcessImageFileName = /(?i)(httpd|nginx|php|php-fpm|w3wp)\.exe?$/
| RemoteAddressIP4 = *
| LocalPort in (80, 443, 8080, 8443)
| join {
    #event_simpleName=ProcessRollup2
    | ImageFileName = /(?i)(httpd|nginx|php|php-fpm|w3wp)\.exe?$/
    | ChildImageFileName = /(?i)(sh|bash|cmd\.exe|powershell\.exe|wget|curl|python)\.?\d*$/
    | groupby([ComputerName, ParentProcessId, ChildProcessId, ChildImageFileName, CommandLine], function=count())
  } [ComputerName, ProcessId=ParentProcessId]
| eval risk=if(match(CommandLine, /(?i)(curl|wget|base64|python|nc |ncat|bash -i|powershell -enc)/), "critical", "high")
| sort -_count
| select ComputerName, ImageFileName, ChildImageFileName, CommandLine, RemoteAddressIP4, LocalPort, risk