WSO2 Multiple Products Path Traversal / Signature Verification Bypass (CVE-2026-5430)

let traversalPatterns = dynamic(["../","..\\","%2e%2e%2f","%2e%2e/","..%2f","%252e%252e%252f","..%255c","%c0%ae"]);
let wso2Paths = dynamic(["/carbon","/services/","/fileupload","/oauth2/","/api/am/","/authenticationendpoint","/repository/"]);
W3CIISLog
| where csUriStem has_any (wso2Paths) or csUriQuery has_any (wso2Paths)
| extend decodedPath = url_decode(strcat(csUriStem, "?", coalesce(csUriQuery, "-")))
| where decodedPath has_any (traversalPatterns) or decodedPath contains ".."
| where decodedPath has_any (dynamic(["repository/conf","wso2carbon",".jks","deployment.toml","secret-conf","web.xml","passwd","cipher-text"]))
| project TimeGenerated, cIP, csMethod, csUriStem, csUriQuery, decodedPath, scStatus, csUserAgent, sSiteName, Computer
| sort by TimeGenerated desc

index=web (sourcetype="ms:iis:auto" OR sourcetype="nginx:plus:kv" OR sourcetype="access_combined")
(uri_path="*/carbon*" OR uri_path="*/services/*" OR uri_path="*/fileupload*" OR uri_path="*/oauth2/*" OR uri_path="*/api/am/*" OR uri_path="*/authenticationendpoint*")
| eval raw_uri=uri_path."?".coalesce(uri_query,"-")
| eval decoded=urldecode(raw_uri)
| where match(decoded,"(?i)(\.\./|\.\.\\|%2e%2e|%252e|\.\.%2f|\.\.%255c)") OR like(decoded,"%..%")
| where match(decoded,"(?i)(repository/conf|wso2carbon|\.jks|deployment\.toml|secret-conf|cipher-text|/etc/passwd|web\.xml)")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(decoded) as payloads values(status) as statuses by src_ip, uri_path, http_user_agent, host
| sort - count

any where event.category == "web" and
  (
    stringContains(url.path, "/carbon") or stringContains(url.path, "/services/") or
    stringContains(url.path, "/fileupload") or stringContains(url.path, "/oauth2/") or
    stringContains(url.path, "/api/am/") or stringContains(url.path, "/authenticationendpoint")
  ) and
  (
    stringContains(url.original, "../") or stringContains(url.original, "..%2f") or
    stringContains(url.original, "%2e%2e") or stringContains(url.original, "%252e") or
    stringContains(url.original, "..%255c")
  ) and
  (
    stringContains(url.original, "repository/conf") or stringContains(url.original, "wso2carbon") or
    stringContains(url.original, ".jks") or stringContains(url.original, "deployment.toml") or
    stringContains(url.original, "secret-conf")
  )

SELECT sourceip, destinationip, "URL", "Request Method", "HTTP Response Code", "User Agent", starttime
FROM events
WHERE ("URL" ILIKE '%/carbon%' OR "URL" ILIKE '%/services/%' OR "URL" ILIKE '%/fileupload%' OR "URL" ILIKE '%/oauth2/%' OR "URL" ILIKE '%/authenticationendpoint%')
AND ( "URL" ILIKE '%..%2f%' OR "URL" ILIKE '%../%' OR "URL" ILIKE '%2e%2e%' OR "URL" ILIKE '%252e%' OR "URL" ILIKE '%..%255c%' )
AND ( "URL" ILIKE '%repository/conf%' OR "URL" ILIKE '%wso2carbon%' OR "URL" ILIKE '%.jks%' OR "URL" ILIKE '%deployment.toml%' OR "URL" ILIKE '%secret-conf%' )
ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=web/wso2* ("/carbon" OR "/services/" OR "/fileupload" OR "/oauth2/" OR "/authenticationendpoint")
| parse regex "(?<method>\S+)\s+(?<uri>\S+)\s+HTTP" nodrop
| where uri matches /(?i).*(\.\.\/|\.\.%2f|%2e%2e|%252e|\.\.%255c).*/
| where uri matches /(?i).*(repository\/conf|wso2carbon|\.jks|deployment\.toml|secret-conf).*/
| count by src_ip, uri, status
| sort by _count

rule wso2_cve_2026_5430_path_traversal {
  meta:
    author = "argus"
    cve = "CVE-2026-5430"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.parsed_user_agent.raw, `.*`) or true
    )
    $e.target.url = /(?i).*(\/carbon|\/services\/|\/fileupload|\/oauth2\/|\/authenticationendpoint).*/
    $e.target.url = /(?i).*(\.\.\/|\.\.%2f|%2e%2e|%252e|\.\.%255c).*/
    $e.target.url = /(?i).*(repository\/conf|wso2carbon|\.jks|deployment\.toml|secret-conf).*/
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    $e
}

#event_simpleName=/HttpRequest|WebProxy/i
| url := lower(url)
| test(regex("(/carbon|/services/|/fileupload|/oauth2/|/authenticationendpoint)", field=url))
| test(regex("(\\.\\./|\\.\\.%2f|%2e%2e|%252e|\\.\\.%255c)", field=url))
| test(regex("(repository/conf|wso2carbon|\\.jks|deployment\\.toml|secret-conf)", field=url))
| groupBy([aid, RemoteAddressIP4, url], function=count())
| sort(_count, order=desc)