Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-54617.
Unlock with Pro - from £29/user/moDetect LaunchServer FileServerHandler Unauthenticated Path Traversal (CVE-2026-54617) in Microsoft Sentinel
Detects exploitation attempts against pro.gravit.launcher:launchserver-api's FileServerHandler, which is vulnerable to an unauthenticated path traversal (CWE-22) allowing arbitrary file read (CWE-200) and disclosure of sensitive data such as credentials or keys (CWE-522) in versions <= 5.7.11. Attackers send crafted HTTP requests containing traversal sequences (../, encoded variants, absolute paths) to the LaunchServer file-serving endpoint to read files outside the intended web root, including server configs, private keys, and auth databases.
MITRE ATT&CK
- Tactic
- Initial Access Collection
KQL Detection Query
let TraversalPatterns = dynamic(["..%2f","..%5c","..\\","../","%2e%2e%2f","%2e%2e/","..%c0%af"]);
W3CIISLog
| where cs_uri_stem has "FileServerHandler" or cs_uri_query has "FileServerHandler"
| where cs_uri_stem has_any (TraversalPatterns) or cs_uri_query has_any (TraversalPatterns)
| extend SourceIP = c_ip
| project TimeGenerated, SourceIP, cs_method, cs_uri_stem, cs_uri_query, sc_status
| union (
AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" or Category == "ApplicationGatewayFirewallLog"
| where requestUri_s has "FileServerHandler" and (requestUri_s has_any (TraversalPatterns))
| project TimeGenerated, SourceIP = clientIp_s, cs_method = "", cs_uri_stem = requestUri_s, cs_uri_query = "", sc_status = 0
)
| sort by TimeGenerated descDetects HTTP requests to LaunchServer's FileServerHandler endpoint containing path traversal sequences, indicating exploitation attempts of CVE-2026-54617.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate URL-encoded characters in filenames used by launcher assets
- Vulnerability scanners performing authorized path traversal testing
- Proxy/CDN rewriting of URIs that coincidentally contains dot-dot sequences
Other platforms for CVE-2026-54617
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Basic path traversal against FileServerHandler
Expected signal: Web/proxy access log entry showing GET request to FileServerHandler with '../' sequences and response body containing /etc/passwd content or a 200 status.
- Test 2URL-encoded traversal against FileServerHandler
Expected signal: Access log entry with percent-encoded traversal sequences in the request URI/query targeting FileServerHandler.
- Test 3Windows-style backslash traversal against FileServerHandler
Expected signal: IIS/web log entry showing a request to FileServerHandler containing '..%5c' sequences and an unusual response size for win.ini content.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-54617 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month