CVE-2026-48558 — SimpleHelp Authentication Bypass (CWE-347)

let SimpleHelpPorts = dynamic([80, 443, 5850, 5900]);
let SuspiciousAdminPaths = dynamic(["/admin", "/api/admin", "/operator", "/technician"]);
union DeviceNetworkEvents, CommonSecurityLog, W3CIISLog
| where TimeGenerated >= ago(7d)
| where (
    (RemotePort in (SimpleHelpPorts) or DestinationPort in (SimpleHelpPorts))
    or (csUriStem has_any (SuspiciousAdminPaths))
  )
| where (
    (csMethod in ("GET", "POST") and (csUriStem has "/admin" or csUriStem has "/operator"))
    or (sc-status in (200, 302) and cs-username == "-" and csUriStem has_any (SuspiciousAdminPaths))
  )
| extend AuthBypassIndicator = case(
    sc-status == 200 and cs-username == "-" and csUriStem has_any (SuspiciousAdminPaths), "Unauthenticated access to admin endpoint",
    sc-status == 302 and csUriStem has "/admin", "Redirect from admin path without auth session",
    "Suspicious SimpleHelp request"
  )
| project TimeGenerated, AuthBypassIndicator, csUriStem, sc-status, cs-username, c-ip, s-ip, csMethod, csUserAgent
| order by TimeGenerated desc

index=web OR index=network OR index=proxy sourcetype IN ("iis", "apache:access", "nginx:plus:kv", "pan:traffic", "squid")
| where (uri_path IN ("/admin", "/operator", "/technician", "/api/admin") OR like(uri_path, "/admin%") OR like(uri_path, "/operator%"))
| eval auth_bypass_indicator=case(
    status==200 AND (isnull(user) OR user="-") AND (like(uri_path, "/admin%") OR like(uri_path, "/operator%")), "Unauthenticated admin access",
    status==302 AND (isnull(user) OR user="-") AND like(uri_path, "/admin%"), "Unauthenticated redirect on admin path",
    status==200 AND like(uri_path, "/technician%") AND (isnull(user) OR user="-"), "Unauthenticated technician panel access",
    true(), "Suspicious SimpleHelp request"
  )
| where auth_bypass_indicator != "Suspicious SimpleHelp request" OR status IN (200, 302)
| stats count AS request_count, values(uri_path) AS accessed_paths, values(status) AS http_statuses, values(auth_bypass_indicator) AS indicators, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip, dest_ip
| where request_count > 1
| sort -request_count

sequence by source.ip with maxspan=5m
  [network where destination.port in (80, 443, 5850, 5900)
   and http.request.method in ("GET", "POST")
   and url.path : ("/admin*", "/operator*", "/technician*", "/api/admin*")]
  [network where destination.port in (80, 443, 5850, 5900)
   and http.response.status_code in (200, 302)
   and url.path : ("/admin*", "/operator*", "/technician*")
   and not (user.name != null and user.name != "-")]

SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  username,
  "HTTP Response Code" AS http_status,
  "HTTP Method" AS http_method,
  LOGSOURCENAME(logsourceid) AS log_source,
  starttime,
  endtime,
  COUNT(*) AS request_count
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Nginx', 'Juniper WebApp Secure')
  AND (
    URL ILIKE '%/admin%'
    OR URL ILIKE '%/operator%'
    OR URL ILIKE '%/technician%'
    OR URL ILIKE '%/api/admin%'
  )
  AND "HTTP Response Code" IN (200, 302)
  AND (username IS NULL OR username = '-' OR username = '')
  AND LAST 7 DAYS
GROUP BY sourceip, destinationip, destinationport, URL, username, http_status, http_method, log_source
HAVING request_count >= 1
ORDER BY request_count DESC

_sourceCategory=web* OR _sourceCategory=network*
| parse regex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).*?\"(?<method>GET|POST|PUT|DELETE|PATCH)\s+(?<uri_path>/[^\s]*).*?\"\s+(?<status_code>\d{3})"
| where status_code in ("200", "302")
| where uri_path matches "/admin*" or uri_path matches "/operator*" or uri_path matches "/technician*" or uri_path matches "/api/admin*"
| parse field=uri_path "*" as path_root nodrop
| if (isnull(username) or username="-" or username="", "unauthenticated", username) as auth_user
| where auth_user = "unauthenticated"
| count as request_count by src_ip, uri_path, status_code, method
| where request_count >= 1
| sort by request_count desc

rule cve_2026_48558_simplehelp_auth_bypass {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects exploitation of CVE-2026-48558 SimpleHelp authentication bypass via unauthenticated access to privileged endpoints"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48558"
    tactic = "TA0001"
    technique = "T1190"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = /GET|POST/
    $http.network.http.response_code = /200|302/
    $http.network.http.request_url = /\/admin|\/operator|\/technician|\/api\/admin/
    not $http.principal.user.userid = /.+/
    $http.target.port = /80|443|5850|5900/

  condition:
    $http
}

#event_simpleName IN ("NetworkConnectIP4", "NetworkConnectIP6", "NetworkReceiveAcceptIP4")
| RemotePort IN [80, 443, 5850, 5900]
| LocalAddressIP4 = *
| HttpMethod IN ["GET", "POST"]
| HttpUrl MATCH "/admin|/operator|/technician|/api/admin"
| HttpStatusCode IN ["200", "302"]
| (HttpUsername = "" OR HttpUsername = "-" OR HttpUsername = null)
| groupBy([RemoteAddressIP4, LocalAddressIP4, HttpUrl, HttpStatusCode, HttpMethod, HttpUsername])
| sort(count, order=desc)
| rename(RemoteAddressIP4, source_ip)
| rename(LocalAddressIP4, dest_ip)
| rename(HttpUrl, requested_path)
| rename(HttpStatusCode, response_code)