Pheditor Hardcoded Default Administrator Credential Exploitation (CVE-2026-55579)

let DefaultCred = "admin";
let Window = 30m;
let AdminLogins = (union isfuzzy=true
    (W3CIISLog | where cs_username =~ DefaultCred and sc_status in (200,302) | project TimeGenerated, SourceIP=c_ip, User=cs_username, Method=cs_method, Uri=cs_uri_stem)
    ,(AppServiceHTTPLogs | where CsUsername =~ DefaultCred | project TimeGenerated, SourceIP=CIp, User=CsUsername, Method=CsMethod, Uri=CsUriStem)
);
AdminLogins
| summarize LoginCount=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Uris=make_set(Uri) by SourceIP, User
| where LoginCount >= 1
| extend Duration = LastSeen - FirstSeen
| project FirstSeen, LastSeen, SourceIP, User, LoginCount, Uris

index=web sourcetype IN ("pheditor:access","apache:access","nginx:access") (uri="*/login*" OR uri="*/admin/login*")
| rex field=_raw "(?i)user(?:name)?=(?<login_user>[^&\s]+)"
| search login_user="admin"
| stats count as attempts, min(_time) as first_seen, max(_time) as last_seen, values(status) as statuses by src_ip, login_user
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| where attempts >= 1
| sort -attempts

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and destination.port in (80, 443, 8080) and http.request.method == "POST" and url.path : ("*/login*", "*/admin/login*") and http.request.body.content : "*admin*"]
  [network where event.category == "network" and http.response.status_code == 200 and url.path : ("*/admin*", "*/dashboard*", "*/settings*")]

SELECT sourceip, username, COUNT(*) as attempt_count, MIN(starttime) as first_seen, MAX(starttime) as last_seen
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Web%'
AND username = 'admin'
AND (URL ILIKE '%/login%' OR URL ILIKE '%/admin/login%')
GROUP BY sourceip, username
ORDER BY attempt_count DESC
LAST 24 HOURS

_sourceCategory=web/access
| parse regex "(?<uri>/[\w/\.-]*login[\w/\.-]*)"
| parse regex "user(?:name)?=(?<login_user>[^&\s]+)"
| where login_user matches "admin"
| count as attempts, min(_messagetime) as first_seen, max(_messagetime) as last_seen by src_ip, login_user
| sort by attempts desc

rule pheditor_default_admin_login {
  meta:
    author = "detection-engineering"
    description = "Detects login to Pheditor using hardcoded default admin credential (CVE-2026-55579)"
    severity = "Critical"
    reference = "https://github.com/pheditor/pheditor/security/advisories/GHSA-p4h7-p9rj-2pq2"
  events:
    $login.metadata.event_type = "USER_LOGIN"
    $login.target.user.userid = "admin"
    $login.network.http.method = "POST"
    $login.target.url = /login/
  condition:
    $login
}

#event_simpleName=HttpRequest
| RequestURI="*login*" OR RequestURI="*/admin/login*"
| RequestBody="*admin*"
| groupBy([RemoteAddressIP4], function=([count(as=attempt_count), min(timestamp, as=first_seen), max(timestamp, as=last_seen)]))
| sort(attempt_count, order=desc)