Synacor Zimbra Collaboration Suite PHP Remote File Inclusion (CVE-2025-68645)

union DeviceNetworkEvents, DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (DeviceName contains "zimbra" or InitiatingProcessCommandLine contains "zimbra" or FolderPath contains "/opt/zimbra")
| where (
    (ActionType == "InboundConnectionAccepted" and RemoteUrl matches regex @"(?i)(https?://[^/]+/.*\.(php|txt|jpg|png|gif)\?.*=https?://|file://|ftp://)")
    or (ProcessCommandLine matches regex @"(?i)(include|require|include_once|require_once)\s*\(.*https?://")
    or (InitiatingProcessCommandLine matches regex @"(?i)curl\s.*-o.*\.php|wget\s.*\.php|fetch.*http")
    or (FolderPath matches regex @"/opt/zimbra/(data/tmp|store|index)/.*\.php$")
)
| project TimeGenerated, DeviceName, ActionType, ProcessCommandLine, InitiatingProcessCommandLine, RemoteUrl, FolderPath, AccountName, RemoteIP
| order by TimeGenerated desc

index=web OR index=os sourcetype IN ("zimbra_access", "zimbra_mailbox", "linux_secure", "syslog")
| eval is_rfi_url=if(match(uri_query, "(?i)(=https?://|=ftp://|=file://|=php://input)"), 1, 0)
| eval is_rfi_cmd=if(match(process, "(?i)(include|require|include_once|require_once).{0,50}https?://"), 1, 0)
| eval is_suspicious_write=if(match(file_path, "/opt/zimbra/(data/tmp|store|index)/.*\.php$"), 1, 0)
| eval is_outbound_fetch=if(match(process, "(?i)(curl|wget|python.*urllib|python.*requests).*http"), 1, 0)
| where is_rfi_url=1 OR is_rfi_cmd=1 OR is_suspicious_write=1 OR is_outbound_fetch=1
| eval zimbra_host=if(match(host, "zimbra") OR match(dest, "zimbra"), 1, 0)
| where zimbra_host=1 OR match(file_path, "/opt/zimbra")
| stats count by _time, host, src_ip, dest_ip, uri_path, uri_query, process, file_path, user
| sort -_time

sequence by host.name with maxspan=5m
  [network where event.type == "connection" and
   destination.port in (80, 443, 8080, 8443) and
   process.name in ("php", "php-fpm", "php7.4", "php8.0", "php8.1", "php8.2") and
   (
     http.request.referrer : "*=http*" or
     url.query : "*=http*" or
     url.query : "*=ftp://*" or
     url.query : "*=php://input*"
   )]
  [file where event.type == "creation" and
   file.path : "/opt/zimbra/*" and
   file.extension == "php" and
   not file.path : "/opt/zimbra/lib/*" and
   not file.path : "/opt/zimbra/zimlets/*"]

SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS event_time,
       sourceip, destinationip, sourceport, destinationport,
       username, URL, "File Path", "Process Name", "Command",
       QIDNAME(qid) as event_name, logsourcename(logsourceid) as log_source
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('LinuxServer','ApacheHTTPServer','NginxWebServer','Syslog')
AND (
  (URL IMATCHES '.*[=&][a-zA-Z_]+=https?://.*'
   AND (URL IMATCHES '.*zimbra.*' OR destinationip INCIDR '0.0.0.0/0'))
  OR
  ("File Path" IMATCHES '/opt/zimbra/(data/tmp|store|index)/.*\.php'
   AND "File Path" NOT IMATCHES '/opt/zimbra/lib/.*')
  OR
  ("Process Name" IMATCHES 'php.*' AND "Command" IMATCHES '.*(include|require).*https?://')
)
AND LAST 7 DAYS
ORDER BY starttime DESC

_sourceCategory=zimbra OR _sourceCategory=webserver/zimbra OR _sourceHost=*zimbra*
| parse regex field=_raw "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*?\"(?P<method>GET|POST|PUT)\s(?P<uri_path>[^\s]+)\s" nodrop
| parse regex field=_raw "(?P<param_kv>[a-zA-Z_0-9]+=(https?://|ftp://|file://|php://input)[^\s&\"]+)" nodrop
| parse regex field=_raw "(?P<rfi_cmd>(?:include|require|include_once|require_once)\s*\(\s*[\$'\"]*https?://)" nodrop
| parse regex field=_raw "(?P<suspicious_file>/opt/zimbra/(?:data/tmp|store|index)/[^\s]+\.php)" nodrop
| where !isEmpty(param_kv) OR !isEmpty(rfi_cmd) OR !isEmpty(suspicious_file)
| count by _sourceHost, src_ip, uri_path, param_kv, rfi_cmd, suspicious_file
| sort by _count desc

rule zimbra_rfi_cve_2025_68645 {
  meta:
    author = "df00tech"
    description = "Detects PHP RFI exploitation in Zimbra ZCS (CVE-2025-68645)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-68645"

  events:
    (
      $e.metadata.event_type = "NETWORK_HTTP"
      and (
        re.regex($e.network.http.request_url, `(?i)[?&][a-zA-Z_]+=https?://`)
        or re.regex($e.network.http.request_url, `(?i)[?&][a-zA-Z_]+=php://input`)
        or re.regex($e.network.http.request_url, `(?i)[?&][a-zA-Z_]+=ftp://`)
      )
      and (
        re.regex($e.target.hostname, `(?i)zimbra`)
        or re.regex($e.target.url, `(?i)/zimbra/`)
        or re.regex($e.target.url, `(?i)/service/`)
      )
    )
    or
    (
      $e.metadata.event_type = "FILE_CREATION"
      and re.regex($e.target.file.full_path, `/opt/zimbra/(data/tmp|store|index)/.*\.php$`)
    )
    or
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.target.process.command_line, `(?i)(include|require|include_once|require_once).*https?://`)
      and re.regex($e.principal.process.file.full_path, `(?i)php`)
    )

  condition:
    $e
}

event_simpleName IN ("ProcessRollup2", "NetworkConnectIP4", "PeFileWritten", "ScriptControlScanTelemetry")
| eval is_zimbra_host=if(match(ComputerName, "zimbra") OR match(LocalAddressIP4, "zimbra"), 1, 0)
| eval is_rfi_url=if(
    match(CommandLine, "(?i)(include|require|include_once|require_once).{0,100}https?://")
    OR match(TargetFileName, "/opt/zimbra/(data/tmp|store|index)/.*\.php$"),
    1, 0)
| eval is_php_outbound=if(
    match(ImageFileName, "(?i)/usr/bin/php|/usr/local/bin/php")
    AND match(CommandLine, "(?i)https?://"),
    1, 0)
| eval is_webshell_indicator=if(
    match(TargetFileName, "/opt/zimbra/") AND match(TargetFileName, "\.php$")
    AND NOT match(TargetFileName, "/opt/zimbra/(lib|zimlets|conf)/"),
    1, 0)
| where is_rfi_url=1 OR is_php_outbound=1 OR is_webshell_indicator=1
| stats count by timestamp, ComputerName, UserName, CommandLine, ImageFileName, TargetFileName, LocalAddressIP4, RemoteAddressIP4
| sort -timestamp