Mautic Campaign Import Path Traversal (CVE-2026-9559)

let SuspiciousPaths = dynamic(["..%2f","..%5c","../../","..\\..\\","%2e%2e%2f","%252e%252e%252f"]);
let ImportEndpoints = dynamic(["/s/campaigns/import","/s/campaigns/batch","campaign.import","/api/campaigns/import"]);
W3CIISLog
| where cs_uri_stem has_any (ImportEndpoints)
| where cs_uri_query has_any (SuspiciousPaths) or cs_method == "POST"
| extend DecodedQuery = url_decode(cs_uri_query)
| where DecodedQuery has_any (SuspiciousPaths)
| project TimeGenerated, c_ip, cs_method, cs_uri_stem, DecodedQuery, sc_status, cs_User_Agent
| union (
    AzureDiagnostics
    | where Category == "ApplicationGatewayAccessLog"
    | where requestUri_s has_any (ImportEndpoints)
    | where httpMethod_s == "POST"
    | extend DecodedUri = url_decode(requestUri_s)
    | where DecodedUri has_any (SuspiciousPaths)
    | project TimeGenerated, c_ip = clientIP_s, cs_method = httpMethod_s, cs_uri_stem = requestUri_s, DecodedQuery = DecodedUri, sc_status = httpStatus_d, cs_User_Agent = userAgent_s
)
| sort by TimeGenerated desc

index=web sourcetype=access_combined OR sourcetype=mautic:access
(uri_path="*campaigns/import*" OR uri_path="*campaigns/batch*" OR uri_path="*api/campaigns/import*")
method=POST
| eval decoded_uri=urldecode(uri_query)
| regex decoded_uri="(\.\.\/|\.\.\\\\|%2e%2e%2f|%252e%252e%252f)"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as endpoints by src_ip, http_user_agent, status
| where count > 0
| sort -last_seen

sequence by http.request.headers.x_forwarded_for with maxspan=5m
  [network where event.category == "network" and url.path : ("*campaigns/import*", "*campaigns/batch*", "*api/campaigns/import*") and http.request.method == "POST" and url.query : ("*..%2f*", "*..%5c*", "*..\/..\/*")]
  [file where event.category == "file" and file.path : ("*/var/www*", "*/webroot*", "*/htdocs*") and not file.path : "*/media/files/import*" and process.name : ("php*", "apache2", "nginx", "php-fpm*")]

SELECT sourceip, destinationip, "URL", httpmethod, httpresponsecode, starttime
FROM events
WHERE LOGSOURCETYPENAME(logsourcetypeid) ILIKE '%Web%'
AND httpmethod = 'POST'
AND ("URL" ILIKE '%campaigns/import%' OR "URL" ILIKE '%campaigns/batch%' OR "URL" ILIKE '%api/campaigns/import%')
AND ("URL" ILIKE '%..%2f%' OR "URL" ILIKE '%..%5c%' OR "URL" ILIKE '%2e%2e%2f%' OR "URL" ILIKE '%252e%252e%')
LAST 24 HOURS

_sourceCategory=web/access
| parse "* * * [*] \"* * *\" * *" as srcip, ident, user, ts, method, uri, proto, status, size
| where method="POST"
| where uri matches "*campaigns/import*" or uri matches "*campaigns/batch*" or uri matches "*api/campaigns/import*"
| where uri matches "*..%2f*" or uri matches "*..%5c*" or uri matches "*%2e%2e%2f*" or uri matches "*..\/..\/*"
| count by srcip, uri, status
| sort -_count

rule mautic_campaign_import_path_traversal_cve_2026_9559 {
  meta:
    author = "detection-engineering"
    description = "Detects path traversal attempts against Mautic campaign import (CVE-2026-9559)"
    severity = "CRITICAL"
    cve = "CVE-2026-9559"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = "POST"
    (re.regex($e.target.url, `(?i)campaigns/(import|batch)`) or re.regex($e.target.url, `(?i)api/campaigns/import`))
    re.regex($e.target.url, `(?i)(\.\.%2f|\.\.%5c|%2e%2e%2f|%252e%252e%252f|\.\./\.\./)`)
  outcome:
    $risk_score = max(85)
    $src_ip = array_distinct($e.principal.ip)
    $target_url = array_distinct($e.target.url)
  condition:
    $e
}

#event_simpleName=HttpRequestEvent
| RequestMethod="POST"
| (RequestURI="*campaigns/import*" OR RequestURI="*campaigns/batch*" OR RequestURI="*api/campaigns/import*")
| (RequestURI="*..%2f*" OR RequestURI="*..%5c*" OR RequestURI="*%2e%2e%2f*" OR RequestURI="*..\/..\/*")
| groupBy([ClientIP, RequestURI, ResponseCode], function=count())
| sort(count, order=desc)