Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Exploitation

union CommonSecurityLog, W3CIISLog
| where TimeGenerated >= ago(7d)
| where (RequestURL contains "/zimbra/" or csUriStem contains "/zimbra/" or RequestURL contains "/service/home/" or csUriStem contains "/service/home/")
| where (
    RequestURL matches regex @"(?i)(<script|javascript:|onerror=|onload=|onmouseover=|onfocus=|<img[^>]+src=|<svg[^>]+onload=|<iframe|<body[^>]+on\w+=|eval\(|document\.cookie|window\.location)"
    or csUriStem matches regex @"(?i)(<script|javascript:|onerror=|onload=|onmouseover=|onfocus=|<img[^>]+src=|<svg[^>]+onload=|<iframe|<body[^>]+on\w+=|eval\(|document\.cookie|window\.location)"
    or RequestBody matches regex @"(?i)(<script|javascript:|onerror=|onload=|eval\(|document\.cookie)"
)
| extend SourceIP = coalesce(SourceIP, cIP)
| extend RequestPath = coalesce(RequestURL, csUriStem)
| project TimeGenerated, SourceIP, RequestPath, RequestMethod = coalesce(RequestMethod, csMethod), ResponseCode = coalesce(EventOutcome, scStatus), UserAgent = coalesce(RequestClientApplication, csUserAgent)
| summarize AttemptCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), RequestPaths = make_set(RequestPath, 20) by SourceIP, UserAgent
| where AttemptCount >= 1
| extend RiskScore = case(AttemptCount >= 10, "High", AttemptCount >= 3, "Medium", "Low")
| sort by AttemptCount desc

index=web OR index=proxy OR index=firewall
| where like(uri_path, "%/zimbra/%") OR like(uri_path, "%/service/home/%") OR like(uri_path, "%/service/soap/%")
| eval xss_indicators=mvappend(
    if(match(uri_query, "(?i)(<script|javascript:|onerror=|onload=|onfocus=|onmouseover=)"), "script_tag_or_event_handler", null()),
    if(match(uri_query, "(?i)(eval\\(|document\\.cookie|window\\.location|String\\.fromCharCode)"), "js_execution_sink", null()),
    if(match(request_body, "(?i)(<script|javascript:|onerror=|onload=|eval\\()"), "body_xss_payload", null()),
    if(match(uri_path, "(?i)(<script|javascript:|onerror=)"), "path_xss_payload", null())
)
| where mvcount(xss_indicators) > 0
| stats count as attempt_count, earliest(_time) as first_seen, latest(_time) as last_seen, values(uri_path) as uri_paths, values(xss_indicators) as indicators, values(status) as response_codes by src_ip, http_user_agent
| eval risk=case(attempt_count >= 10, "high", attempt_count >= 3, "medium", true(), "low")
| sort - attempt_count

sequence by source.ip with maxspan=10m
  [network where event.category == "network" and
   (
     url.path like~ "*/zimbra/*" or
     url.path like~ "*/service/home/*" or
     url.path like~ "*/service/soap/*"
   ) and
   (
     url.query like~ "*<script*" or
     url.query like~ "*javascript:*" or
     url.query like~ "*onerror=*" or
     url.query like~ "*onload=*" or
     url.query like~ "*onfocus=*" or
     url.query like~ "*eval(*" or
     url.query like~ "*document.cookie*" or
     http.request.body.content like~ "*<script*" or
     http.request.body.content like~ "*javascript:*" or
     http.request.body.content like~ "*onerror=*"
   )
  ] with runs=1

SELECT
  sourceip AS src_ip,
  "URL" AS request_url,
  "Method" AS http_method,
  "Response Code" AS response_code,
  "User Agent" AS user_agent,
  LOGSOURCENAME(logsourceid) AS log_source,
  COUNT(*) AS attempt_count,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Microsoft IIS', 'F5 BIG-IP')
  AND (
    "URL" ILIKE '%/zimbra/%'
    OR "URL" ILIKE '%/service/home/%'
    OR "URL" ILIKE '%/service/soap/%'
  )
  AND (
    "URL" ILIKE '%<script%'
    OR "URL" ILIKE '%javascript:%'
    OR "URL" ILIKE '%onerror=%'
    OR "URL" ILIKE '%onload=%'
    OR "URL" ILIKE '%onfocus=%'
    OR "URL" ILIKE '%eval(%'
    OR "URL" ILIKE '%document.cookie%'
    OR "URL" ILIKE '%<svg%onload%'
    OR "URL" ILIKE '%<img%onerror%'
  )
  AND LAST 7 DAYS
GROUP BY sourceip, "URL", "Method", "Response Code", "User Agent"
HAVING attempt_count >= 1
ORDER BY attempt_count DESC

_sourceCategory=web/access OR _sourceCategory=proxy/access OR _sourceCategory=waf
| where (%"cs-uri-stem" matches "*/zimbra/*" or %"cs-uri-stem" matches "*/service/home/*" or uri matches "*/zimbra/*" or uri matches "*/service/home/*")
| where (
    (%"cs-uri-query" matches "*<script*" or %"cs-uri-query" matches "*javascript:*" or %"cs-uri-query" matches "*onerror=*" or %"cs-uri-query" matches "*onload=*" or %"cs-uri-query" matches "*eval(*" or %"cs-uri-query" matches "*document.cookie*")
    OR (uri matches "*<script*" or uri matches "*javascript:*" or uri matches "*onerror=*" or uri matches "*onload=*")
)
| parse field=_raw "\"*\" * *" as request_method, request_uri, http_version nodrop
| count as attempt_count, min(_messageTime) as first_seen, max(_messageTime) as last_seen, values(request_uri) as uris by src_ip, %"cs-user-agent"
| where attempt_count >= 1
| sort by attempt_count desc

rule zimbra_xss_cve_2025_66376 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects XSS exploitation attempts targeting Zimbra Collaboration Suite (CVE-2025-66376)"
    severity = "HIGH"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-66376"
    yara_version = "YL2.0"
    rule_version = "1.0"
  events:
    $req.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($req.target.url, `(?i)/zimbra/`) or
      re.regex($req.target.url, `(?i)/service/home/`) or
      re.regex($req.target.url, `(?i)/service/soap/`)
    )
    (
      re.regex($req.target.url, `(?i)(<script|javascript:|onerror=|onload=|onfocus=|onmouseover=)`) or
      re.regex($req.network.http.request_body, `(?i)(<script|javascript:|onerror=|onload=|eval\()`) or
      re.regex($req.target.url, `(?i)(eval\(|document\.cookie|window\.location|String\.fromCharCode)`)
    )
  condition:
    $req
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| filter (
    RemotePort in (80, 443, 8080, 8443)
    AND (
      HttpURI contains "/zimbra/"
      OR HttpURI contains "/service/home/"
      OR HttpURI contains "/service/soap/"
    )
    AND (
      HttpURI contains "<script"
      OR HttpURI contains "javascript:"
      OR HttpURI contains "onerror="
      OR HttpURI contains "onload="
      OR HttpURI contains "onfocus="
      OR HttpURI contains "eval("
      OR HttpURI contains "document.cookie"
      OR HttpURI contains "<svg"
      OR HttpURI contains "<img"
    )
)
| groupBy([aid, LocalAddressIP4, RemoteAddressIP4, HttpURI, HttpMethod, UserAgent], function=count(1, as=attempt_count))
| sort(attempt_count, order=desc)
| limit 500