Mirasvit Full Page Cache Warmer Deserialization RCE (CVE-2026-45247)

let suspiciousPatterns = dynamic(['/cache-warmer/', '/mirasvit/cachewarmer/', 'O:', 'C:', 'rO0']);
let timeWindow = 1h;
union
(
  W3CIISLog
  | where TimeGenerated >= ago(timeWindow)
  | where csUriStem has_any ('/cache-warmer/', '/mirasvit/', '/cachewarmer/')
  | where csMethod in ('POST', 'PUT')
  | where csBytes > 500
  | extend SuspiciousPayload = csUriQuery has_any ('O:', 'C:', 'rO0') or csBytes > 5000
  | project TimeGenerated, csHost, csMethod, csUriStem, csUriQuery, csBytes, cIP = csClientIP, scStatus, SuspiciousPayload
),
(
  AzureDiagnostics
  | where TimeGenerated >= ago(timeWindow)
  | where Category == 'ApplicationGatewayAccessLog'
  | where requestUri_s has_any ('/cache-warmer/', '/mirasvit/', '/cachewarmer/')
  | where httpMethod_s in ('POST', 'PUT')
  | project TimeGenerated, Host = hostname_s, Method = httpMethod_s, Uri = requestUri_s, ClientIP = clientIP_s, Status = httpStatus_d
),
(
  SecurityAlert
  | where TimeGenerated >= ago(timeWindow)
  | where AlertName has_any ('deserialization', 'php', 'magento')
)
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by tostring(cIP), csHost, csUriStem
| where RequestCount >= 1

index=web OR index=iis OR index=apache sourcetype IN (iis, apache_access, nginx_access, ms:iis:auto)
(uri_path="*/cache-warmer*" OR uri_path="*/mirasvit*cachewarmer*" OR uri_path="*/cachewarmer*")
method IN (POST, PUT)
| eval payload_size=coalesce(bytes, cs_bytes, 0)
| eval suspicious_payload=if(match(uri_query, "(O:|C:|rO0|YTo|Tzo)") OR payload_size > 5000, 1, 0)
| eval post_body_suspicious=if(match(form_data, "(O:|C:|rO0|php|eval|base64)"), 1, 0)
| where suspicious_payload=1 OR post_body_suspicious=1
| stats count as request_count, values(src_ip) as source_ips, min(_time) as first_seen, max(_time) as last_seen, values(status) as http_statuses, values(uri_path) as uris by host, src_ip
| eval risk_score=case(request_count > 10, 90, request_count > 5, 70, true(), 50)
| where request_count >= 1
| sort -risk_score

sequence by source.ip with maxspan=5m
  [network where event.dataset in ("nginx.access", "apache.access", "iis.access")
   and url.path : ("*/cache-warmer*", "*/mirasvit*", "*/cachewarmer*")
   and http.request.method in ("POST", "PUT")
   and http.request.body.bytes > 500]
  [any where event.category == "process"
   and process.name in ("php", "php-fpm", "php7*", "php8*")
   and (
     process.command_line : ("*eval*", "*base64_decode*", "*system(*", "*exec(*", "*shell_exec(*", "*passthru(*")
     or process.parent.name in ("nginx", "apache2", "httpd", "php-fpm")
   )]

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') as event_time,
  sourceip,
  destinationip,
  URL,
  username,
  "HTTP Method" as http_method,
  "HTTP Response Code" as http_status,
  "Bytes Sent" as payload_size,
  LOGSOURCENAME(logsourceid) as log_source,
  CATEGORYNAME(category) as event_category
FROM events
WHERE
  devicetime > NOW() - 3600000
  AND (
    URL ILIKE '%cache-warmer%'
    OR URL ILIKE '%cachewarmer%'
    OR URL ILIKE '%mirasvit%warmer%'
  )
  AND "HTTP Method" IN ('POST', 'PUT')
  AND (
    "Bytes Sent" > 1000
    OR PAYLOAD ILIKE '%O:%'
    OR PAYLOAD ILIKE '%rO0%'
    OR PAYLOAD ILIKE '%unserialize%'
  )
ORDER BY devicetime DESC
LIMIT 1000

_sourceCategory=web/access OR _sourceCategory=iis OR _sourceCategory=apache
| where (%"cs-uri-stem" matches "*cache-warmer*" or %"cs-uri-stem" matches "*mirasvit*" or url matches "*cachewarmer*")
| where method in ("POST", "PUT")
| json field=_raw "bytes" as payload_bytes nodrop
| json field=_raw "cs-bytes" as cs_bytes nodrop
| eval payload_size = coalesce(payload_bytes, cs_bytes, 0)
| eval has_serialized_marker = if (matches(_raw, ".*O:[0-9]+:.*|.*rO0.*|.*YTo.*|.*Tzo.*"), 1, 0)
| where payload_size > 1000 or has_serialized_marker = 1
| stats count as hits, first(_messagetime) as first_seen, last(_messagetime) as last_seen, values(status) as statuses by src_ip, _sourceHost, url
| sort by hits desc

rule cve_2026_45247_mirasvit_cache_warmer_deser {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2026-45247 Mirasvit Full Page Cache Warmer deserialization vulnerability"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-45247"
    mitre_attack = "T1190"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = /POST|PUT/
    (
      $http.network.http.referral_url = /cache-warmer/
      or $http.target.url = /cache-warmer/
      or $http.target.url = /mirasvit.*warmer/
      or $http.target.url = /cachewarmer/
    )
    (
      $http.network.sent_bytes > 1000
      or $http.network.http.referral_url = /O:[0-9]+:/
      or $http.target.url = /rO0/
    )
    $http.principal.ip = $src_ip

  match:
    $src_ip over 10m

  outcome:
    $risk_score = max(80)
    $event_count = count_distinct($http.metadata.id)

  condition:
    $http
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=HttpRequest
| CommandLine = /cache-warmer|cachewarmer|mirasvit.*warmer/i
  OR RequestUrl = /cache-warmer|cachewarmer|mirasvit.*warmer/i
| HttpMethod IN ["POST", "PUT"]
| eval suspicious = case(
    match(RequestBody, "O:[0-9]+:") OR match(RequestBody, "rO0") OR match(RequestBody, "YTo"), "serialized_payload",
    BytesSent > 5000, "large_payload",
    true(), "standard"
  )
| where suspicious != "standard"
| groupby([RemoteAddressIP4, ComputerName, RequestUrl, HttpMethod, suspicious], function=count(aid, as=request_count))
| sort(request_count, order=desc)
| search request_count >= 1