Widget Factory Joomla Content Editor Improper Access Control (CVE-2026-48907)

union isfuzzy=true
(
  CommonSecurityLog
  | where TimeGenerated >= ago(24h)
  | where RequestURL has_any ("/index.php?option=com_jce", "/plugins/editors/jce", "/components/com_jce")
  | where RequestURL has_any ("task=plugin", "task=upload", "task=save", "view=editor")
  | where RequestMethod in ("POST", "PUT")
  | extend UserAgent = tostring(RequestClientApplication)
  | where ResponseCode in (200, 201, 302)
  | project TimeGenerated, SourceIP, DestinationHostName, RequestURL, RequestMethod, ResponseCode, UserAgent, Activity
),
(
  W3CIISLog
  | where TimeGenerated >= ago(24h)
  | where csUriStem has_any ("/index.php", "/components/com_jce", "/plugins/editors/jce")
  | where csUriQuery has_any ("option=com_jce", "task=plugin", "task=upload")
  | where csMethod in ("POST", "PUT")
  | where scStatus in (200, 201, 302)
  | project TimeGenerated, cIP, csHost, csUriStem, csUriQuery, csMethod, scStatus, csUserAgent
)
| summarize RequestCount = count(), UniqueURLs = dcount(RequestURL), StatusCodes = make_set(ResponseCode) by SourceIP, bin(TimeGenerated, 5m)
| where RequestCount > 3
| order by RequestCount desc

index=web OR index=proxy
| where earliest=-24h
| search (uri_path="*/index.php*" AND uri_query="*option=com_jce*") OR uri_path="*/components/com_jce*" OR uri_path="*/plugins/editors/jce*"
| search uri_query="*task=plugin*" OR uri_query="*task=upload*" OR uri_query="*task=save*" OR uri_query="*view=editor*"
| search http_method=POST OR http_method=PUT
| search status=200 OR status=201 OR status=302
| stats count AS request_count, dc(uri_query) AS unique_params, values(status) AS status_codes, values(uri_path) AS paths BY src_ip, span(1m,5m)
| where request_count > 3
| eval risk_score=case(request_count > 20, "critical", request_count > 10, "high", request_count > 3, "medium", true(), "low")
| table _time, src_ip, request_count, unique_params, status_codes, paths, risk_score
| sort -request_count

sequence by source.ip with maxspan=5m
  [network where event.category == "network_traffic" and http.request.method in ("POST", "PUT")
   and (
     url.path : "*/index.php*" and url.query : "*option=com_jce*"
     or url.path : "*/components/com_jce*"
     or url.path : "*/plugins/editors/jce*"
   )
   and url.query : ("*task=plugin*", "*task=upload*", "*task=save*")
   and http.response.status_code in (200, 201, 302)
  ] with runs=3

SELECT
  sourceip,
  COUNT(*) AS request_count,
  ARRAY_AGG(DISTINCT "URL") AS target_urls,
  ARRAY_AGG(DISTINCT "HTTP Response Code") AS response_codes,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Nginx')
  AND (
    ("URL" ILIKE '%index.php%' AND "URL" ILIKE '%option=com_jce%')
    OR "URL" ILIKE '%/components/com_jce%'
    OR "URL" ILIKE '%/plugins/editors/jce%'
  )
  AND (
    "URL" ILIKE '%task=plugin%'
    OR "URL" ILIKE '%task=upload%'
    OR "URL" ILIKE '%task=save%'
  )
  AND "HTTP Method" IN ('POST', 'PUT')
  AND "HTTP Response Code" IN (200, 201, 302)
  AND LOGSOURCETIME(starttime) > NOW() - 1 HOURS
GROUP BY sourceip
HAVING COUNT(*) > 3
ORDER BY request_count DESC

_sourceCategory=web/access/logs OR _sourceCategory=proxy/logs
| where _messageTime > now() - 86400000
| parse regex "(?<src_ip>\\d+\\.\\d+\\.\\d+\\.\\d+).*\"(?<method>POST|PUT) (?<url>[^\"]+)\".*(?<status>\\d{3})"
| where (url matches "*index.php*" and url matches "*option=com_jce*") 
   or url matches "*/components/com_jce*" 
   or url matches "*/plugins/editors/jce*"
| where url matches "*task=plugin*" or url matches "*task=upload*" or url matches "*task=save*"
| where status in ("200", "201", "302")
| timeslice 5m
| count by src_ip, _timeslice
| where _count > 3
| sort by _count desc
| fields _timeslice, src_ip, _count

rule cve_2026_48907_jce_access_control_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-48907 exploitation attempts against Widget Factory Joomla Content Editor plugin"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48907"
    cve = "CVE-2026-48907"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = /^(POST|PUT)$/
    (
      (
        $e.network.http.request_url = /\/index\.php/ and
        $e.network.http.request_url = /option=com_jce/
      ) or
      $e.network.http.request_url = /\/components\/com_jce/ or
      $e.network.http.request_url = /\/plugins\/editors\/jce/
    )
    (
      $e.network.http.request_url = /task=plugin/ or
      $e.network.http.request_url = /task=upload/ or
      $e.network.http.request_url = /task=save/
    )
    $e.network.http.response_code = /^(200|201|302)$/
    $e.principal.ip = $src_ip

  match:
    $src_ip over 5m

  condition:
    #e > 3
}

#event_simpleName=NetworkReceiveAcceptIP4 OR #event_simpleName=NetworkConnectIP4
| event_platform=Lin OR event_platform=Win
| RemotePort in (80, 443, 8080, 8443)
| LocalAddressIP4 != "127.0.0.1"
| join type=inner
  [
    #event_simpleName=ProcessRollup2
    | ImageFileName in ("/usr/sbin/apache2", "/usr/sbin/httpd", "/usr/bin/php", "/usr/sbin/nginx", "php-fpm")
    | CommandLine = /com_jce|option=com_jce|task=upload|task=plugin/
    | groupby([aid, ContextProcessId], function=[collect([CommandLine, ImageFileName, UserName])])
  ]
  [aid, ContextProcessId]
| stats count() AS connection_count, values(CommandLine) AS commands, values(ImageFileName) AS processes by RemoteAddressIP4, aid
| where connection_count > 2
| sort -connection_count