LaunchServer FileServerHandler Unauthenticated Path Traversal (CVE-2026-54617)

let TraversalPatterns = dynamic(["..%2f","..%5c","..\\","../","%2e%2e%2f","%2e%2e/","..%c0%af"]);
W3CIISLog
| where cs_uri_stem has "FileServerHandler" or cs_uri_query has "FileServerHandler"
| where cs_uri_stem has_any (TraversalPatterns) or cs_uri_query has_any (TraversalPatterns)
| extend SourceIP = c_ip
| project TimeGenerated, SourceIP, cs_method, cs_uri_stem, cs_uri_query, sc_status
| union (
  AzureDiagnostics
  | where ResourceType == "APPLICATIONGATEWAYS" or Category == "ApplicationGatewayFirewallLog"
  | where requestUri_s has "FileServerHandler" and (requestUri_s has_any (TraversalPatterns))
  | project TimeGenerated, SourceIP = clientIp_s, cs_method = "", cs_uri_stem = requestUri_s, cs_uri_query = "", sc_status = 0
)
| sort by TimeGenerated desc

index=web_proxy OR index=iis (uri="*FileServerHandler*" OR url="*FileServerHandler*")
| regex uri="(\.\.%2f|\.\.%5c|\.\.\\\\|\.\.\/|%2e%2e%2f|%2e%2e\/|\.\.%c0%af)"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, dest_ip, http_method
| where count > 0
| sort -count

any where event.dataset == "nginx.access" or event.dataset == "apache.access" and
  url.path : "*FileServerHandler*" and
  (url.original : "*..%2f*" or url.original : "*..%5c*" or url.original : "*../*" or url.original : "*%2e%2e%2f*" or url.original : "*..%c0%af*")

SELECT sourceip, destinationip, "URL", starttime
FROM events
WHERE "URL" ILIKE '%FileServerHandler%'
AND ("URL" ILIKE '%..%2f%' OR "URL" ILIKE '%..%5c%' OR "URL" ILIKE '%../%' OR "URL" ILIKE '%%2e%2e%2f%' OR "URL" ILIKE '%..%c0%af%')
LAST 24 HOURS

_sourceCategory=*web* OR _sourceCategory=*proxy*
| parse "* * * \"* * *\" * *" as clientip, ident, user, method, uri, protocol, status, size
| where uri matches "*FileServerHandler*"
| where uri matches "*..%2f*" or uri matches "*..%5c*" or uri matches "*../*" or uri matches "*%2e%2e%2f*" or uri matches "*..%c0%af*"
| count by clientip, uri, status
| sort -_count

rule launchserver_fileserverhandler_path_traversal {
  meta:
    author = "detection-engineering"
    description = "Detects path traversal attempts against LaunchServer FileServerHandler (CVE-2026-54617)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /FileServerHandler/ nocase
    re.regex($e.target.url, `(\.\.%2f|\.\.%5c|\.\.\/|%2e%2e%2f|\.\.%c0%af)`)
  condition:
    $e
}

#event_simpleName=HttpRequest
| RequestURI="*FileServerHandler*"
| RequestURI="*..%2f*" OR RequestURI="*..%5c*" OR RequestURI="*../*" OR RequestURI="*%2e%2e%2f*" OR RequestURI="*..%c0%af*"
| groupBy([ClientIP, RequestURI, ResponseCode], function=count())
| sort(count, order=desc)