Cisco Catalyst SD-WAN Manager Path Traversal Exploitation

union CommonSecurityLog, W3CIISLog
| where TimeGenerated >= ago(24h)
| where RequestURL has_any ("../", "..%2f", "..%2F", "%2e%2e%2f", "%2e%2e/", "..%5c", "%2e%2e%5c")
| where RequestURL has_any ("/dataservice/", "/management/", "/template/", "/config/")
| extend TraversalDepth = array_length(extract_all(@"(\.\./|\.\.\/|%2e%2e%2f|%2e%2e/)", RequestURL))
| where TraversalDepth >= 1
| extend TargetPath = extract(@"(?:\.\./|%2e%2e%2f|%2e%2e/)+([^?#]+)", 1, RequestURL)
| where TargetPath has_any ("etc/passwd", "etc/shadow", "etc/hosts", "proc/", "var/log", "home/", ".ssh", "authorized_keys", "id_rsa", "config", "credentials")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, TargetPath, TraversalDepth, RequestMethod, ResponseCode, DeviceVendor, DeviceProduct
| order by TimeGenerated desc

index=network OR index=web sourcetype IN ("cisco:sdwan", "pan:traffic", "cisco:asa", "access_combined", "iis")
| search uri IN ("*../*", "*..%2f*", "*..%2F*", "*%2e%2e%2f*", "*%2e%2e/*", "*..%5c*", "*%2e%2e%5c*")
| rex field=uri "(?P<traversal_seq>(?:\.\./|%2e%2e[%2f/])+)(?P<target_path>[^?#]+)"
| where match(uri, "/dataservice/|/management/|/template/|/config/")
| eval sensitive_target=if(match(target_path, "etc/passwd|etc/shadow|etc/hosts|proc/|var/log|\.ssh|authorized_keys|id_rsa|credentials"), "YES", "NO")
| eval traversal_count=mvcount(split(uri, "../")) - 1
| where traversal_count >= 1
| stats count AS attempt_count, values(uri) AS traversal_uris, values(target_path) AS targeted_paths, dc(src_ip) AS unique_sources BY src_ip, dest_ip, sensitive_target
| where attempt_count >= 1
| sort - attempt_count

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   url.path : ("*../*", "*..%2f*", "*..%2F*", "*%2e%2e%2f*", "*%2e%2e/*") and
   url.path : ("*/dataservice/*", "*/management/*", "*/template/*", "*/config/*")]
  [network where event.category == "network" and
   http.response.status_code in (200, 201, 206) and
   url.path : ("*../*", "*..%2f*", "*..%2F*")]

SELECT
  sourceip AS "Source IP",
  destinationip AS "Destination IP",
  URL AS "Request URL",
  username AS "Username",
  "Response Code" AS response_code,
  LOGSOURCENAME(logsourceid) AS "Log Source",
  starttime AS "Event Time"
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Cisco SD-WAN', 'Apache HTTP Server', 'Microsoft IIS', 'Nginx')
  AND (
    URL ILIKE '%../%'
    OR URL ILIKE '%..%2f%'
    OR URL ILIKE '%..%2F%'
    OR URL ILIKE '%25%32%65%25%32%65%'
    OR URL ILIKE '%2e%2e%2f%'
    OR URL ILIKE '%2e%2e/%'
  )
  AND (
    URL ILIKE '%/dataservice/%'
    OR URL ILIKE '%/management/%'
    OR URL ILIKE '%/template/%'
    OR URL ILIKE '%/config/%'
  )
  AND LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory=network/cisco/sdwan OR _sourceCategory=web/access
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*?\"(?:GET|POST|PUT|DELETE|HEAD) (?P<uri>\S+)"
| where uri matches "*../*" OR uri matches "*..%2f*" OR uri matches "*..%2F*" OR uri matches "*%2e%2e%2f*" OR uri matches "*%2e%2e/*"
| where uri matches "*/dataservice/*" OR uri matches "*/management/*" OR uri matches "*/template/*" OR uri matches "*/config/*"
| parse field=uri "*" as raw_uri nodrop
| if(uri matches "*etc/passwd*" OR uri matches "*etc/shadow*" OR uri matches "*.ssh*" OR uri matches "*id_rsa*", "sensitive", "unknown") as target_sensitivity
| count by src_ip, uri, target_sensitivity
| sort by _count desc

rule cisco_sdwan_path_traversal_cve_2026_20262 {
  meta:
    author = "df00tech"
    description = "Detects path traversal exploitation of CVE-2026-20262 in Cisco Catalyst SD-WAN Manager"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-arbfw-c2rZvQ"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.request_url = /\.\.[\/\\]|\.\.[%][2][fF]|[%]2[eE][%]2[eE][%]2[fF]/ nocase
    $e.network.http.request_url = /\/dataservice\/|\/management\/|\/template\/|\/config\// nocase
    $ip = $e.principal.ip

  match:
    $ip over 10m

  outcome:
    $event_count = count_distinct($e.metadata.id)
    $targeted_urls = array_distinct($e.network.http.request_url)
    $response_codes = array_distinct($e.network.http.response_code)

  condition:
    #e >= 1
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=NetworkConnectIP4
| event_platform=Lin
| ProcessImageFileName IN ("/opt/cisco/sdwan/*", "/usr/bin/vmanage*", "*sdwan*")
| CommandLine = /(\.\.\/|\.\.[%][2][fF]|[%][2][eE][%][2][eE])/i
| CommandLine = /(dataservice|management|template|config)/i
| stats count() AS attempt_count, values(CommandLine) AS commands, values(RemoteAddressIP4) AS remote_ips BY UserName, LocalAddressIP4, attempt_count
| sort attempt_count desc
| search attempt_count >= 1