Mautic Server-Side Template Injection (SSTI) in Theme Templates

let ThemeTwigMarkers = dynamic(['{{', '}}', '{%', '%}', '_self', 'getFilter', '__construct', 'system(', 'exec(', 'passthru(', 'proc_open(', 'shell_exec(']);
AppServiceHTTPLogs
| where ScmType == "" or CsHost has "mautic"
| where CsUriStem has_any ("/s/themes", "/s/emails", "/s/pages", "/s/dynamicContent", "/theme/upload", "/api/themes")
| where CsMethod in ("POST", "PUT")
| extend DecodedBody = url_decode(tostring(CsUriQuery))
| where DecodedBody has_any (ThemeTwigMarkers) or CsUriQuery has_any (ThemeTwigMarkers)
| project TimeGenerated, CIp, CsMethod, CsUriStem, CsUriQuery, ScStatus, CsUserAgent
| order by TimeGenerated desc

index=web sourcetype=access_combined OR sourcetype=mautic:access
(uri_path="*/s/themes*" OR uri_path="*/s/emails*" OR uri_path="*/s/pages*" OR uri_path="*/theme/upload*" OR uri_path="*/api/themes*")
method IN ("POST","PUT")
| eval decoded_uri=urldecode(uri_query)
| regex decoded_uri="(\{\{|\{%|_self|getFilter|__construct|system\(|exec\(|passthru\(|proc_open\(|shell_exec\()"
| table _time, clientip, method, uri_path, decoded_uri, status, http_user_agent
| sort -_time

sequence by http.client_ip with maxspan=5m
  [network where event.dataset == "nginx.access" and http.request.method in ("POST", "PUT") and url.path : ("*/s/themes*", "*/s/emails*", "*/s/pages*", "*/theme/upload*", "*/api/themes*") and (url.query : "*%7B%7B*" or url.query : "*__construct*" or url.query : "*system(*")]
  [process where event.type == "start" and process.parent.name : ("php-fpm*", "php*", "apache2*", "nginx*") and process.name in ("sh", "bash", "whoami", "id", "curl", "wget", "python*", "perl")]

SELECT sourceip, destinationip, "URL", httpMethod, httpStatusCode, payload, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Web%'
AND ("URL" ILIKE '%/s/themes%' OR "URL" ILIKE '%/s/emails%' OR "URL" ILIKE '%/s/pages%' OR "URL" ILIKE '%/theme/upload%' OR "URL" ILIKE '%/api/themes%')
AND httpMethod IN ('POST','PUT')
AND (UTF8(payload) ILIKE '%{{%' OR UTF8(payload) ILIKE '%__construct%' OR UTF8(payload) ILIKE '%system(%' OR UTF8(payload) ILIKE '%getFilter%')
LAST 24 HOURS

_sourceCategory=web/access OR _sourceCategory=mautic/app
| where method matches "POST" or method matches "PUT"
| where uri_path matches "*\/s\/themes*" or uri_path matches "*\/s\/emails*" or uri_path matches "*\/s\/pages*" or uri_path matches "*\/theme\/upload*" or uri_path matches "*\/api\/themes*"
| parse regex "(?<decoded_query>.*)" from uri_query
| where decoded_query matches "*{{*" or decoded_query matches "*__construct*" or decoded_query matches "*system(*" or decoded_query matches "*getFilter*"
| timeslice 5m
| count by _timeslice, clientip, uri_path
| sort by _count desc

rule mautic_ssti_cve_2026_9558 {
  meta:
    author = "df00tech"
    description = "Detects Twig SSTI payload markers in HTTP requests to Mautic theme/email endpoints (CVE-2026-9558)"
    severity = "CRITICAL"
  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = "POST" or $http.network.http.method = "PUT"
    re.regex($http.target.url, `(?i)/s/(themes|emails|pages)|/theme/upload|/api/themes`)
    re.regex($http.target.url, `(?i)(%7B%7B|__construct|system\(|getFilter|proc_open)`)
  outcome:
    $risk_score = max(85)
  condition:
    $http
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName IN ("php-fpm", "php", "apache2", "httpd", "nginx")
| in(field=FileName, values=["sh", "bash", "whoami", "id", "curl", "wget", "python3", "perl", "nc"])
| join(field=[ComputerName], mode=inner, query={#event_simpleName=NetworkConnectIP4 | RemotePort=443 or RemotePort=80}, include=[RemoteAddressIP4])
| table([@timestamp, ComputerName, ParentBaseFileName, FileName, CommandLine, RemoteAddressIP4])