Which SIEM platforms have a CVE-2025-54236 detection rule?

df00tech provides CVE-2025-54236 (Adobe Commerce / Magento Improper Input Validation (CVE-2025-54236)) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the CVE-2025-54236 detection?

The CVE-2025-54236 detection is rated critical severity with medium confidence.

What are common false positives for CVE-2025-54236?

Common false positives for CVE-2025-54236 include: Legitimate bulk API operations from integration partners or ERP systems sending large POST payloads; Automated e-commerce workflows (order sync, inventory updates) triggering high request volumes; Security scanners or penetration testing tools targeting the Magento application.

CVE-2025-54236 IBM QRadar · QRadar

Detect Adobe Commerce / Magento Improper Input Validation (CVE-2025-54236) in IBM QRadar

Q: What data sources are required to detect Adobe Commerce / Magento Improper Input Validation (CVE-2025-54236) (CVE-2025-54236)?

Detecting Adobe Commerce / Magento Improper Input Validation (CVE-2025-54236) requires the following data sources: IIS Logs, Azure Application Gateway, WAF/Proxy Logs, CommonSecurityLog.

Detects exploitation of CVE-2025-54236, an improper input validation vulnerability in Adobe Commerce and Magento. This KEV-listed vulnerability allows attackers to submit maliciously crafted input to Commerce/Magento endpoints, potentially leading to remote code execution, unauthorized data access, or store compromise. Detection focuses on anomalous HTTP request patterns to Magento/Commerce endpoints, unexpected PHP execution, and indicators of post-exploitation activity.

MITRE ATT&CK

Tactic: Initial Access Execution Persistence Impact

QRadar Detection Query

IBM QRadar (QRadar)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  URL,
  Method,
  "HTTP Response Code" AS response_code,
  "Bytes Sent" AS bytes_sent,
  COUNT(*) AS request_count
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Apache HTTP Server', 'NGINX', 'F5 BIG-IP')
  AND (
    URL ILIKE '%/rest/%'
    OR URL ILIKE '%/graphql%'
    OR URL ILIKE '%/index.php/rest/%'
    OR URL ILIKE '%/admin/index.php%'
    OR URL ILIKE '%/downloader/%'
  )
  AND Method IN ('POST', 'PUT', 'PATCH')
  AND LAST 24 HOURS
GROUP BY
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm'),
  sourceip,
  destinationip,
  URL,
  Method,
  "HTTP Response Code",
  "Bytes Sent"
HAVING
  COUNT(*) > 5
  OR "Bytes Sent" > 50000
ORDER BY request_count DESC

high severity medium confidence

QRadar AQL query identifying unusual POST/PUT/PATCH activity to Adobe Commerce and Magento endpoints, filtering for high-frequency or large-payload requests that may indicate CVE-2025-54236 exploitation.

Data Sources

IIS Log SourceApache HTTP ServerNginxF5 BIG-IP

Required Tables

events

False Positives & Tuning

Bulk product catalog imports via REST API from ERP integrations
High-volume order processing from B2B customers using API keys
Legitimate third-party Magento extensions making frequent API calls
Load testing performed against Commerce instances during off-hours maintenance

Other platforms for CVE-2025-54236

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1Magento REST API Malformed Input Fuzzing
Expected signal: Web server access logs should show POST requests to /rest/V1/products and /rest/V1/customers with large Content-Length values and HTTP 400/500 response codes
Test 2PHP Web Shell Upload via Compromised Magento Admin
Expected signal: IIS/Apache logs showing POST to admin CMS endpoint; filesystem monitoring alerts on new .php file creation in pub/media/; process execution logs if PHP is evaluated
Test 3Rapid Sequential API Endpoint Reconnaissance
Expected signal: Web server access logs showing rapid sequential POST requests to multiple /rest/V1/ endpoints from a single source IP within a short timeframe

Last updated: 2026-06-19 Research depth: standard

References (3)

Response Playbook

Triage

Identify source IPs making repeated POST/PUT/PATCH requests to /rest/, /graphql, or /admin/ endpoints and cross-reference against threat intelligence feeds for known malicious actors.
Review HTTP response codes for the flagged requests — a pattern of HTTP 200 responses to unusual payloads or HTTP 500 errors from malformed input strongly indicates active exploitation attempts.
Check server-side PHP error logs (/var/log/php*, /var/log/apache2/error.log, Windows Event Log Application) for eval() errors, unexpected function calls, or PHP fatal errors correlating with the suspicious request timestamps.
Determine Adobe Commerce and Magento version to confirm whether it falls within the affected range and whether the relevant security patches have been applied.

Containment

Immediately block source IPs identified in triage at the WAF or network perimeter if exploitation is confirmed; consider geo-blocking if the attack originates from unexpected regions.
Place the Adobe Commerce/Magento application in maintenance mode (`php bin/magento maintenance:enable`) to prevent further exploitation while patches are applied and forensic analysis is completed.

Evidence Collection

Capture and preserve web server access logs (IIS/Apache/Nginx) covering the exploitation window, including full URI paths, request bodies where logged, response codes, and timing data.
Collect PHP error logs, Magento exception logs (var/log/exception.log, var/log/system.log), and any WAF alert logs. Archive the Magento codebase snapshot to detect any webshells or modified files using `find /var/www/html -name '*.php' -newer /var/www/html/pub/index.php -ls`.

Escalation Criteria

!Escalate immediately if evidence of successful code execution is found — e.g., new PHP files in pub/, media/, or var/ directories, or unexpected child processes from the web server user.
!Escalate to incident response if customer PII, payment card data (PCI scope), or admin credentials may have been accessed or exfiltrated, triggering breach notification obligations.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

>Web server access logs showing anomalous POST/PUT requests to /rest/, /graphql, /index.php/rest/ with unusual payloads or response patterns
>PHP error logs containing eval(), preg_replace() with /e modifier, assert(), or similar dangerous function call traces
>Filesystem artifacts: newly created or modified .php files in pub/media/, pub/static/, var/, or app/ directories that were not part of a legitimate deployment
>Process execution history showing web server worker processes (php-fpm, apache, w3wp) spawning shells, curl, wget, or other unexpected child processes

Tuning Guidance

Start by baselining legitimate API integration IPs (ERP systems, PIM tools, payment gateways) and adding them to allowlists to reduce false positives. Adjust the request count threshold (default: >10 per 5 minutes) based on your environment's API usage patterns — high-volume B2B Commerce instances may require a higher threshold (50+) or time-of-day restrictions. If your WAF logs request bodies, add payload-based rules to detect PHP function signatures (eval, base64_decode, system) directly, which will dramatically improve confidence. For environments without web server log forwarding, prioritize deploying Falcon or an equivalent EDR agent to catch process spawn anomalies as a compensating control.

Hunting Queries

Threat hunt for successful (HTTP 200) POST requests to Magento REST and GraphQL endpoints over the past 7 days. Helps identify exploitation that may have occurred before detection rules were deployed.

Hunting — KQL

kql

W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ('/rest/', '/graphql', '/index.php/rest/')
| where csMethod in ('POST', 'PUT', 'PATCH')
| where scStatus == 200
| summarize count() by csUriStem, cIP, bin(TimeGenerated, 1h)
| where count_ > 3
| order by count_ desc

Hunting — SPL

spl

index=web (uri_path="*/rest/*" OR uri_path="*/graphql*") method=POST status=200 earliest=-7d
| stats count by src_ip, uri_path, _time span=1h
| where count > 3
| sort - count

Atomic Red Team Tests

Test 1 Magento REST API Malformed Input Fuzzing

linux

Simulates an attacker probing the Magento REST API with oversized and malformed input payloads to trigger improper input validation behavior consistent with CVE-2025-54236.

Command

bash

#!/bin/bash
# Lab/authorized testing only — target your own Magento test instance
TARGET_HOST="http://magento-lab.internal"

# Test 1: Large payload to REST endpoint
curl -s -X POST "${TARGET_HOST}/rest/V1/products" \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer REPLACE_WITH_TEST_TOKEN' \
  -d '{"product":{"sku":"'$(python3 -c "print('A'*65536)'","name":"Test"}}' \
  -w "\nHTTP_STATUS:%{http_code}" -o /tmp/test1_response.txt

# Test 2: Special characters in input fields
curl -s -X POST "${TARGET_HOST}/rest/V1/customers" \
  -H 'Content-Type: application/json' \
  -d '{"customer":{"email":"test+<script>alert(1)</script>@test.com","firstname":"\"\';DROP TABLE--","lastname":"Test"}}' \
  -w "\nHTTP_STATUS:%{http_code}" -o /tmp/test2_response.txt

echo "Test results saved to /tmp/test1_response.txt and /tmp/test2_response.txt"
cat /tmp/test1_response.txt
cat /tmp/test2_response.txt

Cleanup

bash

rm -f /tmp/test1_response.txt /tmp/test2_response.txt

Expected Telemetry

Web server access logs should show POST requests to /rest/V1/products and /rest/V1/customers with large Content-Length values and HTTP 400/500 response codes

Expected Detection

SPL and KQL queries should trigger on the large payload size (>50000 bytes) and high request rate thresholds

Test 2 PHP Web Shell Upload via Compromised Magento Admin

linux

Simulates post-exploitation activity where an attacker uploads a PHP web shell through Magento's file upload functionality after gaining admin access via CVE-2025-54236.

Command

bash

#!/bin/bash
# Lab/authorized testing only
TARGET_HOST="http://magento-lab.internal"
ADMIN_PATH="/admin_lab123"

# Simulate web shell upload to pub/media (commonly writable)
# The 'shell' content here is a benign echo command for lab detection testing
MINIMAL_TEST_PAYLOAD='<?php echo "CVE-2025-54236-test-" . phpversion(); ?>'

curl -s -X POST "${TARGET_HOST}${ADMIN_PATH}/cms_block/save/" \
  -b 'PHPSESSID=lab_test_session' \
  -F "content=${MINIMAL_TEST_PAYLOAD}" \
  -F "title=test" \
  -F "identifier=test-block" \
  -w "\nHTTP_STATUS:%{http_code}" \
  -o /tmp/webshell_test_response.txt

echo "Response:"; cat /tmp/webshell_test_response.txt

Cleanup

bash

rm -f /tmp/webshell_test_response.txt; # Remove any test files created in pub/media/ on the test server

Expected Telemetry

IIS/Apache logs showing POST to admin CMS endpoint; filesystem monitoring alerts on new .php file creation in pub/media/; process execution logs if PHP is evaluated

Expected Detection

CrowdStrike CQL process spawn detection if the payload executes; filesystem integrity monitoring alerts on new PHP files in web-accessible directories

Test 3 Rapid Sequential API Endpoint Reconnaissance

linux

Simulates an attacker rapidly probing multiple Magento REST API endpoints to identify vulnerable input vectors, matching the scanning behavior that precedes CVE-2025-54236 exploitation.

Command

bash

#!/bin/bash
# Lab/authorized testing only — run against your own Magento test instance
TARGET_HOST="http://magento-lab.internal"

ENDPOINTS=(
  "/rest/V1/products"
  "/rest/V1/customers"
  "/rest/V1/orders"
  "/rest/V1/carts"
  "/graphql"
  "/rest/V1/store/storeConfigs"
  "/rest/V1/directory/countries"
)

for endpoint in "${ENDPOINTS[@]}"; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
    "${TARGET_HOST}${endpoint}" \
    -H 'Content-Type: application/json' \
    -d '{"test":"CVE-2025-54236-probe"}')
  echo "[$(date +%T)] POST ${endpoint} -> HTTP ${STATUS}"
  sleep 0.5
done

Cleanup

bash

No cleanup required — read-only probe test

Expected Telemetry

Web server access logs showing rapid sequential POST requests to multiple /rest/V1/ endpoints from a single source IP within a short timeframe

Expected Detection

KQL and SPL detection rules should fire on the high request rate (7+ requests in under 5 minutes) to Magento API endpoints from a single IP

Related Detections

Tactic Hubs

TA0001Initial Access TA0002Execution TA0003Persistence TA0040Impact

Related Techniques

T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter T1505.003Web Shell

Detect Adobe Commerce / Magento Improper Input Validation (CVE-2025-54236) in IBM QRadar

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2025-54236

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

MITRE ATT&CK

QRadar Detection Query

Data Sources

Required Tables

False Positives & Tuning

Other platforms for CVE-2025-54236

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Related Techniques

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Command

Cleanup

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Related Techniques

Same Tactic: Initial Access

Popular Detections

Get new detections in your inbox