TrueConf Server Missing Authentication for Critical Function (CVE-2026-72529)

let adminPaths = dynamic(["/admin", "/api/v1/", "/api/config", "/settings", "/users/create", "/system/", "/security/"]);
let sensitiveMethods = dynamic(["POST", "PUT", "DELETE", "PATCH"]);
W3CIISLog
| where csUriStem has_any (adminPaths)
| where csMethod in (sensitiveMethods) or csUriStem contains "config"
| where isempty(csUsername) or csUsername == "-" or isempty(csCookie) or csCookie == "-"
| where scStatus in (200, 201, 204, 302)
| summarize RequestCount = count(), Paths = make_set(csUriStem, 20), Methods = make_set(csMethod, 10) by cIP, sSitename, bin(TimeGenerated, 10m)
| where RequestCount >= 1
| project TimeGenerated, cIP, sSitename, RequestCount, Paths, Methods

index=web (sourcetype="iis" OR sourcetype="trueconf:access" OR sourcetype="apache:access")
(uri_path="*/admin*" OR uri_path="*/api/*" OR uri_path="*config*" OR uri_path="*/settings*" OR uri_path="*/system/*" OR uri_path="*/users/create*")
(method=POST OR method=PUT OR method=DELETE OR method=PATCH)
status IN (200,201,204,302)
(user="-" OR user="" OR isnull(user)) (cookie="-" OR cookie="" OR isnull(cookie))
| stats count AS request_count values(uri_path) AS paths values(method) AS methods by src_ip, dest, _time span=10m
| where request_count >= 1

sequence by source.ip with maxspan=10m
  [ network where url.path : ("*/admin*", "*/api/*", "*config*", "*/settings*", "*/system/*") and
    http.request.method in ("POST", "PUT", "DELETE", "PATCH") and
    http.response.status_code in (200, 201, 204, 302) and
    (user.name == null or user.name == "-") ]

SELECT sourceip, destinationip, "URL" AS url, "httpMethod" AS method, "httpResponseCode" AS status, COUNT(*) AS request_count
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft IIS', 'Apache HTTP Server')
AND ("URL" ILIKE '%/admin%' OR "URL" ILIKE '%/api/%' OR "URL" ILIKE '%config%' OR "URL" ILIKE '%/settings%' OR "URL" ILIKE '%/system/%')
AND "httpMethod" IN ('POST','PUT','DELETE','PATCH')
AND "httpResponseCode" IN ('200','201','204','302')
AND ("username" IS NULL OR "username" = '-')
GROUP BY sourceip, destinationip, url, method, status
LAST 1 HOURS

_sourceCategory=*iis* OR _sourceCategory=*trueconf* OR _sourceCategory=*web*
| parse regex "(?<method>\w+)\s+(?<uri>\S+)\s+HTTP" nodrop
| parse regex "\s(?<status>\d{3})\s" nodrop
| where uri matches /.*(\/admin|\/api\/|config|\/settings|\/system\/).*/
| where method in ("POST","PUT","DELETE","PATCH")
| where status in ("200","201","204","302")
| where isBlank(user) OR user = "-"
| count as request_count, values(uri) as paths by src_ip, _sourceHost
| where request_count >= 1

rule trueconf_cve_2026_72529_missing_auth {
  meta:
    author = "Argus Detection Platform"
    description = "Unauthenticated privileged access to TrueConf Server admin endpoints (CVE-2026-72529)"
    severity = "HIGH"
    cve = "CVE-2026-72529"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.network.http.parsed_user_agent, ".*") 
    $e.target.url = /.*(\/admin|\/api\/|config|\/settings|\/system\/).*/ nocase
    $e.network.http.method = /POST|PUT|DELETE|PATCH/
    $e.network.http.response_code = 200 or $e.network.http.response_code = 201 or $e.network.http.response_code = 302
    $e.principal.user.userid = ""
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    $e
}

#event_simpleName=/HttpRequest|WebRequest/
| in(field="UrlPath", values=["*/admin*", "*/api/*", "*config*", "*/settings*", "*/system/*"])
| in(field="HttpMethod", values=["POST","PUT","DELETE","PATCH"])
| in(field="HttpStatusCode", values=["200","201","204","302"])
| case { RemoteUser="-" | RemoteUser="" ; * }
| groupBy([RemoteAddressIP4, ComputerName], function=[count(as=request_count), collect([UrlPath, HttpMethod])])
| request_count >= 1