SmarterMail Missing Authentication for Critical Function (CVE-2026-24423)

union isfuzzy=true
(
  W3CIISLog
  | where csUriStem has_any ("/api/", "/admin/", "/settings/", "/interface/", "/services/")
  | where csMethod in ("POST", "PUT", "DELETE", "PATCH")
  | where isempty(csUsername) or csUsername == "-"
  | where scStatus in (200, 201, 204, 302)
  | extend AuthBypass = true
),
(
  AzureDiagnostics
  | where ResourceType == "APPLICATIONGATEWAYS"
  | where requestUri_s has_any ("/api/", "/admin/", "/settings/", "/interface/")
  | where httpMethod_s in ("POST", "PUT", "DELETE")
  | where userAgent_s !has "Mozilla" or isempty(userAgent_s)
)
| extend SmarterMailServer = Computer
| project TimeGenerated, SmarterMailServer, csClientIP, csUriStem, csMethod, scStatus, csUsername, csUserAgent
| where TimeGenerated > ago(1h)

index=web OR index=iis sourcetype=iis OR sourcetype=ms:iis:auto
| search (uri_path="*/api/*" OR uri_path="*/admin/*" OR uri_path="*/settings/*" OR uri_path="*/interface/*" OR uri_path="*/services/*")
| search (method=POST OR method=PUT OR method=DELETE OR method=PATCH)
| search (status=200 OR status=201 OR status=204 OR status=302)
| where isnull(cs_username) OR cs_username="-" OR cs_username=""
| eval auth_bypass=if(isnull(cs_username) OR cs_username="-", "true", "false")
| stats count as request_count, values(uri_path) as endpoints, values(status) as status_codes, dc(c_ip) as unique_ips by cs_ip, _time
| where request_count > 1
| sort -request_count
| rename cs_ip as source_ip

sequence by source.ip with maxspan=5m
  [network where event.dataset == "iis.access" and
   url.path : ("*/api/*", "*/admin/*", "*/settings/*", "*/interface/*") and
   http.request.method : ("POST", "PUT", "DELETE", "PATCH") and
   (not exists(user.name) or user.name == "-" or user.name == "") and
   http.response.status_code in (200, 201, 204, 302)]
  [network where event.dataset == "iis.access" and
   url.path : ("*/admin/*", "*/settings/*") and
   http.response.status_code in (200, 201)]

SELECT
  sourceip,
  destinationip,
  URL,
  username,
  "HTTP Method" as http_method,
  "HTTP Response Code" as response_code,
  starttime,
  COUNT(*) as request_count
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%IIS%'
  AND (URL ILIKE '%/api/%' OR URL ILIKE '%/admin/%' OR URL ILIKE '%/settings/%' OR URL ILIKE '%/interface/%')
  AND "HTTP Method" IN ('POST', 'PUT', 'DELETE', 'PATCH')
  AND (username IS NULL OR username = '-' OR username = '')
  AND "HTTP Response Code" IN (200, 201, 204, 302)
  AND LOGSOURCENAME(logsourceid) ILIKE '%SmarterMail%'
GROUP BY sourceip, destinationip, URL, username, http_method, response_code, starttime
HAVING COUNT(*) > 1
LAST 60 MINUTES

_sourceCategory=iis OR _sourceCategory=webserver
| parse "* * * * * * * * *" as date, time, s_sitename, s_computername, s_ip, cs_method, cs_uri_stem, cs_uri_query, s_port
| parse "* * * * * *" as cs_username, c_ip, cs_useragent, cs_referer, sc_status, sc_bytes
| where cs_uri_stem matches "*/api/*" or cs_uri_stem matches "*/admin/*" or cs_uri_stem matches "*/settings/*" or cs_uri_stem matches "*/interface/*"
| where cs_method in ("POST", "PUT", "DELETE", "PATCH")
| where isNull(cs_username) or cs_username = "-" or cs_username = ""
| where sc_status in ("200", "201", "204", "302")
| timeslice 5m
| count by c_ip, cs_uri_stem, cs_method, sc_status, _timeslice
| where _count > 1
| sort by _count desc

rule smartermail_missing_auth_cve_2026_24423 {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects unauthenticated access to SmarterMail critical endpoints (CVE-2026-24423)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://www.cve.org/CVERecord?id=CVE-2026-24423"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = /POST|PUT|DELETE|PATCH/
    $e.network.http.referral_url = /smartermail|smarter\.mail/i or
    $e.target.url = /\/api\/|\/admin\/|\/settings\/|\/interface\//
    not $e.network.http.user_agent = /""/
    ($e.principal.user.userid = "-" or not $e.principal.user.userid != "")
    $e.network.http.response_code in (200, 201, 204, 302)

  condition:
    $e
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=NetworkConnectIP4
| UserName = "-" OR UserName = ""
| RemotePort IN (80, 443, 8080, 9998)
| CommandLine = /smartermail/i OR ImageFileName = /smartermail/i
| RemotePath IN ("/api/", "/admin/", "/settings/", "/interface/", "/services/")
| groupBy([SourceIP, RemoteIP, RemotePath, UserName], function=count(1, as=ConnectionCount))
| ConnectionCount > 2
| sort(ConnectionCount, order=desc)