CVE-2025-58048: Paymenter Remote Code Execution via Unrestricted File Upload

let suspiciousExtensions = dynamic(['.php', '.php3', '.php4', '.php5', '.phtml', '.phar', '.asp', '.aspx', '.jsp', '.py', '.rb', '.pl', '.sh', '.bash', '.cgi']);
let uploadPaths = dynamic(['/upload', '/uploads', '/files', '/public/uploads', '/storage/app/public']);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (80, 443, 8080, 8443)
| join kind=inner (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where ActionType in ('FileCreated', 'FileModified')
    | where FolderPath has_any (uploadPaths)
    | where FileName has_any (suspiciousExtensions)
    | project DeviceId, FileCreationTime=Timestamp, FileName, FolderPath, InitiatingProcessName, InitiatingProcessCommandLine
) on DeviceId
| where abs(datetime_diff('second', Timestamp, FileCreationTime)) < 60
| extend RiskIndicator = case(
    FileName endswith '.php' or FileName endswith '.phtml', 'PHP webshell upload',
    FileName endswith '.jsp', 'JSP webshell upload',
    FileName endswith '.sh' or FileName endswith '.bash', 'Shell script upload',
    'Suspicious executable upload'
)
| project Timestamp, DeviceId, DeviceName, RemoteIP, RemotePort, FileName, FolderPath, InitiatingProcessName, InitiatingProcessCommandLine, RiskIndicator
| order by Timestamp desc

index=web OR index=main sourcetype IN (access_combined, apache_access, nginx_access, php_error)
| eval file_ext=lower(mvindex(split(uri_path, "."), -1))
| where match(uri_path, "(?i)/(upload|uploads|files|storage|public)") AND match(http_method, "^POST$")
| eval is_suspicious_ext=if(file_ext IN ("php","php3","php4","php5","phtml","phar","asp","aspx","jsp","sh","bash","py","pl","cgi"), 1, 0)
| where is_suspicious_ext=1 OR status IN ("200", "201") AND match(uri_path, "(?i)\.(php|phtml|phar|jsp|asp|aspx|sh|bash|py|pl)")
| eval severity=case(
    file_ext IN ("php","phtml","phar"), "critical",
    file_ext IN ("asp","aspx","jsp"), "critical",
    file_ext IN ("sh","bash","py","pl"), "high",
    true(), "medium"
  )
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as upload_paths values(status) as http_statuses by src_ip, file_ext, severity
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort -count
| table src_ip, file_ext, severity, count, first_seen, last_seen, upload_paths, http_statuses

sequence by host.id with maxspan=2m
  [network where event.type == "connection" and destination.port in (80, 443, 8080, 8443) and http.request.method == "POST" and url.path like~ "*/upload*" or url.path like~ "*/files*" or url.path like~ "*/storage*"]
  [file where event.type in ("creation", "change") and (
    file.extension in ("php", "php3", "php4", "php5", "phtml", "phar", "asp", "aspx", "jsp", "sh", "bash", "py", "pl", "cgi")
  ) and (
    file.path like~ "*/uploads/*" or file.path like~ "*/storage/app/public/*" or file.path like~ "*/public/files/*"
  )]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  QIDNAME(qid) as event_name,
  CATEGORYNAME(category) as category_name,
  'CVE-2025-58048' as cve_reference
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'nginx', 'Microsoft IIS')
  AND (LOWER(URL) LIKE '%/upload%' OR LOWER(URL) LIKE '%/files%' OR LOWER(URL) LIKE '%/storage/app/public%')
  AND (LOWER(URL) LIKE '%.php' OR LOWER(URL) LIKE '%.phtml' OR LOWER(URL) LIKE '%.phar'
       OR LOWER(URL) LIKE '%.asp' OR LOWER(URL) LIKE '%.aspx' OR LOWER(URL) LIKE '%.jsp'
       OR LOWER(URL) LIKE '%.sh' OR LOWER(URL) LIKE '%.bash' OR LOWER(URL) LIKE '%.py')
  AND HTTP_METHOD = 'POST'
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=webserver/access OR _sourceCategory=nginx/access OR _sourceCategory=apache/access
| parse regex "(?<method>GET|POST|PUT|DELETE|PATCH) (?<uri_path>[^\s]+)" nodrop
| parse regex "\s(?<status_code>\d{3})\s" nodrop
| where method = "POST"
| where uri_path matches "*/upload*" or uri_path matches "*/files*" or uri_path matches "*/storage/app/public*" or uri_path matches "*/public/uploads*"
| parse regex field=uri_path "\.(?<file_ext>[^./?]+)(?:[?#].*)?$" nodrop
| where toLowerCase(file_ext) in ("php","php3","php4","php5","phtml","phar","asp","aspx","jsp","sh","bash","py","pl","cgi")
| where status_code in ("200", "201", "204")
| timeslice 5m
| stats count as upload_count, values(uri_path) as upload_paths, values(status_code) as status_codes by _timeslice, _sourceHost, src_ip, file_ext
| sort by _timeslice desc
| fields _timeslice, src_ip, _sourceHost, file_ext, upload_count, upload_paths, status_codes

rule cve_2025_58048_paymenter_rce_file_upload {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2025-58048 Paymenter unrestricted file upload RCE exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/Paymenter/Paymenter/security/advisories/GHSA-5pm9-r2m8-rcmj"
    cve = "CVE-2025-58048"

  events:
    $e1.metadata.event_type = "NETWORK_HTTP"
    $e1.network.http.method = "POST"
    (
      $e1.network.http.target_url = /\/upload[s]?\// nocase or
      $e1.network.http.target_url = /\/storage\/app\/public\// nocase or
      $e1.network.http.target_url = /\/public\/files\// nocase
    )
    (
      $e1.network.http.target_url = /\.(php|php3|php4|php5|phtml|phar|asp|aspx|jsp|sh|bash|py|pl|cgi)(\?|$|#)/ nocase or
      $e1.target.file.full_path = /\.(php|php3|php4|php5|phtml|phar|asp|aspx|jsp|sh|bash|py|pl|cgi)$/ nocase
    )
    $e1.network.http.response_code >= 200
    $e1.network.http.response_code < 300
    $ip = $e1.principal.ip

  match:
    $ip over 10m

  outcome:
    $risk_score = max(95)
    $upload_count = count($e1.metadata.id)
    $target_url = array_distinct($e1.network.http.target_url)

  condition:
    $e1
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=NetworkConnectIP4
| CommandLine = /paymenter|php|artisan/i
| join (
    #event_simpleName=FileOpenInfo
    | FilePath = /\/(uploads?|storage\/app\/public|public\/files)\//i
    | FileName = /\.(php[0-9]?|phtml|phar|asp[x]?|jsp|sh|bash|py|pl|cgi)$/i
    | eval FileExtension=lower(match_regex(FileName, @"\.[^.]+$"))
    | select timestamp, aid, FileName, FilePath, FileExtension, UserName
  ) on aid
| eval TimeDiffSeconds = abs(timestamp - #timestamp)
| where TimeDiffSeconds < 120
| groupBy([aid, FileName, FilePath, FileExtension, RemoteAddressIP4], function=[
    count(as=upload_count),
    min(timestamp, as=first_seen),
    max(timestamp, as=last_seen),
    collect(UserName, as=users)
  ])
| where upload_count > 0
| eval RiskLevel=if(FileExtension in ("php","phtml","phar","asp","aspx","jsp"), "CRITICAL", "HIGH")
| sort(field=first_seen, order=desc)