PrestaShop ps_facetedsearch PHP Object Injection Leading to Unauthenticated RCE (CVE-2026-54159)

let SuspiciousMarkers = dynamic(["O:8:\"","O:9:\"","O:10:\"","php_ext","phar://","__wakeup","__destruct","unserialize"]);
W3CIISLog
| where cs_uri_stem has "module/ps_facetedsearch" or cs_uri_query has "ps_facetedsearch"
| where cs_method == "POST"
| extend DecodedQuery = url_decode(cs_uri_query)
| where DecodedQuery has_any (SuspiciousMarkers) or cs_bytes > 20000
| project TimeGenerated, cIP, csUserAgent=cs_User_Agent, cs_uri_stem, DecodedQuery, sc_status
| sort by TimeGenerated desc

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access (uri_path="*ps_facetedsearch*" OR uri_query="*ps_facetedsearch*")
| eval decoded_query=urldecode(uri_query)
| rex field=decoded_query "(?<obj_marker>O:\d+:\\\"[A-Za-z0-9_\\\\]+\\\")"
| where isnotnull(obj_marker) OR match(decoded_query, "phar://") OR match(decoded_query, "__wakeup") OR match(decoded_query, "__destruct")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(obj_marker) as markers by src_ip, http_user_agent
| sort -count

network where event.category == "network" and
  http.request.method in ("POST","GET") and
  url.path : "*ps_facetedsearch*" and
  (url.query : "*O\\:*\\:*\"*" or url.query : "*phar://*" or url.query : "*__wakeup*" or url.query : "*__destruct*")

SELECT sourceip, destinationip, "URL", username, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Web%'
AND ("URL" ILIKE '%ps_facetedsearch%')
AND ("URL" ILIKE '%O%3A%3A%22%' OR "URL" ILIKE '%phar%3A%2F%2F%' OR "URL" ILIKE '%__wakeup%' OR "URL" ILIKE '%__destruct%')
LAST 24 HOURS

_sourceCategory=web/access
| where uri_path matches "*ps_facetedsearch*"
| parse regex "(?<decoded_query>(?:.*))" as decoded_query nodrop
| where decoded_query matches "*O:*:*\"*" or decoded_query matches "*phar://*" or decoded_query matches "*__wakeup*" or decoded_query matches "*__destruct*"
| count by src_ip, uri_path
| sort by _count desc

rule prestashop_facetedsearch_phpobjinjection_cve_2026_54159 {
  meta:
    author = "detection-engineering"
    description = "Detects PHP Object Injection attempts against PrestaShop ps_facetedsearch module (CVE-2026-54159)"
    severity = "CRITICAL"
    cve = "CVE-2026-54159"
  events:
    $web.metadata.event_type = "NETWORK_HTTP"
    $web.target.url = /.*ps_facetedsearch.*/ nocase
    $web.network.http.method = "POST" or $web.network.http.method = "GET"
    re.regex($web.target.url, `(O:\d+:\"|phar://|__wakeup|__destruct)`)
  condition:
    $web
}

#event_simpleName=HttpRequest
| RequestURI=/*ps_facetedsearch*/
| in(field=RequestMethod, values=["POST","GET"])
| regex(field=RequestURI, pattern="(O:\\d+:\"|phar://|__wakeup|__destruct)")
| table([RequestURI, RequestMethod, ClientIP, RemoteAddressIP4, ContextTimeStamp])