Gogs Path Traversal Vulnerability (CVE-2025-8110)

union isfuzzy=true
  (
    CommonSecurityLog
    | where DeviceVendor has_any ("nginx", "apache", "caddy", "haproxy")
    | where RequestURL matches regex @"(\.\./|%2e%2e%2f|%2e%2e/|\.%2e/|%252e%252e|\.\.\\|%2e%2e%5c)"
    | where RequestURL has_any ("/etc/passwd", "/etc/shadow", "app.ini", "id_rsa", ".ssh", "conf/app.ini")
    | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationHostName, RequestURL, RequestMethod, DeviceAction
  ),
  (
    W3CIISLog
    | where csUriStem matches regex @"(\.\./|%2e%2e%2f|%2e%2e/|\.%2e/|%252e%252e)"
    | where csUriStem has_any ("/etc/passwd", "/etc/shadow", "app.ini", "id_rsa", ".ssh")
    | project TimeGenerated, cIP, csHost, csUriStem, csMethod, scStatus
  ),
  (
    AzureDiagnostics
    | where Category == "ApplicationGatewayAccessLog"
    | where requestUri_s matches regex @"(\.\./|%2e%2e%2f|%2e%2e/|\.%2e/|%252e%252e)"
    | where requestUri_s has_any ("/etc/passwd", "app.ini", "id_rsa", ".ssh")
    | project TimeGenerated, clientIP_s, host_s, requestUri_s, httpMethod_s, httpStatus_i
  )
| summarize RequestCount=count(), UniqueURLs=dcount(RequestURL), EarliestEvent=min(TimeGenerated) by SourceIP, RequestURL
| where RequestCount >= 1
| extend Severity="High", AlertName="Gogs Path Traversal Attempt CVE-2025-8110"

index=web OR index=proxy OR index=waf sourcetype IN ("access_combined", "nginx:plus:kv", "iis", "apache:access", "pan:traffic")
| eval decoded_uri=urldecode(uri)
| where match(uri, "(\.\./|%2e%2e%2f|%2e%2e/|\.%2e/|%252e%252e|%2e%2e%5c)")
   OR match(decoded_uri, "\.\.[\/\\]")
| where match(decoded_uri, "(app\.ini|/etc/passwd|/etc/shadow|id_rsa|\.ssh/|conf/app\.ini|custom/conf)")
| eval traversal_depth=mvcount(split(replace(decoded_uri, "%2f", "/"), "../"))
| stats count AS request_count, values(uri) AS traversal_uris, dc(uri) AS unique_paths, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip, host, http_method
| where request_count >= 1
| eval alert_name="Gogs Path Traversal CVE-2025-8110", severity="critical"

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and network.direction == "inbound"
   and (
     url.path : ("*../*", "*%2e%2e%2f*", "*%2e%2e/*", "*..%2f*", "*%252e%252e*")
     or url.original : ("*../*", "*%2e%2e%2f*", "*%2e%2e/*", "*..%2f*", "*%252e%252e*")
   )
   and (
     url.path : ("*app.ini*", "*/etc/passwd*", "*/etc/shadow*", "*id_rsa*", "*.ssh/*", "*conf/app.ini*")
     or url.original : ("*app.ini*", "*/etc/passwd*", "*id_rsa*", "*.ssh/*")
   )
  ] with runs=1

SELECT
  sourceip,
  destinationip,
  URL,
  'HTTP_METHOD' AS http_method,
  starttime,
  eventcount,
  logsourcename(logsourceid) AS log_source
FROM events
WHERE
  category = 'HTTP' OR logsourcetypename(devicetype) ILIKE '%web%' OR logsourcetypename(devicetype) ILIKE '%proxy%'
  AND (
    URL ILIKE '%../%' OR
    URL ILIKE '%..\\%' OR
    URL ILIKE '%2e%2e%2f%' OR
    URL ILIKE '%2e%2e/%' OR
    URL ILIKE '%252e%252e%' OR
    URL ILIKE '%2e%2e%5c%'
  )
  AND (
    URL ILIKE '%app.ini%' OR
    URL ILIKE '%etc/passwd%' OR
    URL ILIKE '%etc/shadow%' OR
    URL ILIKE '%id_rsa%' OR
    URL ILIKE '%.ssh%' OR
    URL ILIKE '%conf/app.ini%'
  )
  AND LOGSOURCETIME(starttime) > NOW() - 1 HOURS
ORDER BY starttime DESC
LAST 1 HOURS

_sourceCategory=web* OR _sourceCategory=proxy* OR _sourceCategory=nginx* OR _sourceCategory=apache*
| parse regex "(?<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}).*?\"(?<http_method>\\w+) (?<request_uri>\\S+)"
| where request_uri matches /(\.\.\/|%2e%2e%2f|%2e%2e\/|\.%2e\/|%252e%252e|%2e%2e%5c)/
| where request_uri matches /(app\.ini|\/etc\/passwd|\/etc\/shadow|id_rsa|\.ssh\/|conf\/app\.ini)/
| urldecode request_uri as decoded_uri
| count as request_count by src_ip, request_uri, decoded_uri, http_method
| where request_count >= 1
| sort by request_count desc
| fields src_ip, request_uri, decoded_uri, http_method, request_count

rule gogs_path_traversal_cve_2025_8110 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects path traversal exploitation attempts against Gogs (CVE-2025-8110)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-8110"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method != ""
    (
      re.regex($e.network.http.request_url, `(\.\./|%2e%2e%2f|%2e%2e/|\.%2e/|%252e%252e|%2e%2e%5c)`) or
      re.regex($e.target.url, `(\.\./|%2e%2e%2f|%2e%2e/|\.%2e/|%252e%252e)`)
    )
    (
      strings.contains($e.network.http.request_url, "app.ini") or
      strings.contains($e.network.http.request_url, "/etc/passwd") or
      strings.contains($e.network.http.request_url, "/etc/shadow") or
      strings.contains($e.network.http.request_url, "id_rsa") or
      strings.contains($e.network.http.request_url, ".ssh") or
      strings.contains($e.network.http.request_url, "conf/app.ini")
    )
    $e.principal.ip = $src_ip

  match:
    $src_ip over 5m

  outcome:
    $risk_score = max(85)
    $event_count = count_distinct($e.network.http.request_url)
    $target_host = array_distinct($e.target.hostname)

  condition:
    #e >= 1
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=NetworkConnectIP4
| ImageFileName=/gogs/i OR LocalPort IN (3000, 80, 443)
| join {
    #event_simpleName=ProcessRollup2
    | ImageFileName=/gogs/i
    | fields aid, ContextProcessId, ImageFileName, CommandLine
  } [aid, ContextProcessId]
| in(field="CommandLine", values=[".*/.*\\.\\./.*", ".*%2e%2e%2f.*", ".*%252e%252e.*"])
| stats count() AS connection_count, values(RemoteAddressIP4) AS remote_ips BY aid, ImageFileName, CommandLine
| where connection_count >= 1
| eval alert="Gogs Path Traversal Attempt CVE-2025-8110"