From ef8d0f450d4df9005bdf106827c535b8129edcfc Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 26 Jul 2023 10:50:50 -0600
Subject: [PATCH 1/8] Create citrix_sharefile_rce_cve_2023_24489.yml

---
 .../citrix_sharefile_rce_cve_2023_24489.yml   | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 stories/citrix_sharefile_rce_cve_2023_24489.yml

diff --git a/stories/citrix_sharefile_rce_cve_2023_24489.yml b/stories/citrix_sharefile_rce_cve_2023_24489.yml
new file mode 100644
index 0000000000..0e013d9a75
--- /dev/null
+++ b/stories/citrix_sharefile_rce_cve_2023_24489.yml
@@ -0,0 +1,24 @@
+name: Citrix ShareFile RCE CVE-2023-24489
+id: 10c7e01a-5743-4995-99df-a66f6b5db653
+version: 1
+date: '2023-07-26'
+author: Michael Haag, Splunk
+description: A critical vulnerability has been discovered in ShareFile's Storage Zones Controller software (CVE-2023-24489), used by numerous organizations for file sharing and storage. The vulnerability allows unauthenticated arbitrary file upload and remote code execution due to a cryptographic bug in the software's encryption but lack of authentication system. The risk comes from a failing encryption check, allowing potential cybercriminals to upload malicious files to the server. The bug was found in the Documentum Connector's .aspx files. The security risk has a potentially large impact due to the software's wide use and the sensitivity of the stored data. Citrix has released a security update to address this issue.
+narrative: The ShareFile Storage Zones Controller is a .NET web application running under IIS, which manages the storage of files in ShareFile's system. It was discovered that this software has a critical vulnerability (CVE-2023-24489) in the file upload functionality provided by the Documentum Connector's .aspx files. Specifically, the security flaw lies in the encryption check in the file upload process which could be bypassed, allowing for unauthenticated arbitrary file uploads and remote code execution.
+
+  The application sets the current principal from a session cookie, but if this is missing, the application continues without authentication. The application uses AES encryption, with CBC mode and PKCS#7 padding. A decryption check is in place which returns an error if the decryption fails, but this can be bypassed by supplying a ciphertext that results in valid padding after decryption, thereby not causing an exception. \
+
+  The Documentum Connector's upload.aspx file, when uploading a file, calls the ProcessRawPostedFile function, which allows a path traversal due to improper sanitization of the 'uploadId' parameter. It allows the 'filename' and 'uploadId' parameters to be concatenated, and while the 'filename' parameter is sanitized, the 'uploadId' is not. The 'parentid' parameter is passed in but is also not used. \
+
+  The vulnerability enables an attacker to upload a webshell or any other malicious file, by providing a properly padded encrypted string for the 'parentid' parameter, and specifying the path for the 'uploadId' and the name for the 'filename'. An attacker can achieve remote code execution by requesting the uploaded file. The issue was addressed by Citrix in a recent security update.
+references: 
+- https://www.greynoise.io/blog/introducing-cve-2023-24489-a-critical-citrix-sharefile-rce-vulnerability
+- https://blog.assetnote.io/2023/07/04/citrix-sharefile-rce/
+tags:
+  analytic_story: Citrix ShareFile RCE CVE-2023-24489
+  category: []
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

From 01d9c4a9b296df413cb2087df54c2084eb523bb0 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 26 Jul 2023 12:09:00 -0600
Subject: [PATCH 2/8] Citrx

---
 .../detect_webshell_exploit_behavior.yml      |  1 +
 ..._sharefile_exploitation_cve_2023_24489.yml | 63 +++++++++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml

diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/detect_webshell_exploit_behavior.yml
index bede99f459..567e1d055f 100644
--- a/detections/endpoint/detect_webshell_exploit_behavior.yml
+++ b/detections/endpoint/detect_webshell_exploit_behavior.yml
@@ -43,6 +43,7 @@ tags:
   - HAFNIUM Group
   - BlackByte Ransomware
   - CISA AA22-264A
+  - Citrix ShareFile RCE CVE-2023-24489
   asset_type: Endpoint
   confidence: 80
   impact: 100
diff --git a/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
new file mode 100644
index 0000000000..97d41aeb56
--- /dev/null
+++ b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
@@ -0,0 +1,63 @@
+name: Citrix ShareFile Exploitation CVE-2023-24489
+id: 172c59f2-5fae-45e5-8e51-94445143e93f
+version: 1
+date: '2023-07-26'
+author: Michael Haag, Splunk
+status: production
+type: Hunting
+data_source: []
+description: The following analytic detects a potentially malicious file upload attempt to Documentum, an enterprise content management platform, via specific suspicious URLs and the HTTP POST method. This detection occurs through pattern recognition within the datamodel=Web, focusing on URL patterns that follow "/documentum/upload.aspx?parentid=", "/documentum/upload.aspx?filename=", "/documentum/upload.aspx?uploadId=*", combined with the HTTP POST method, indicative of a file upload attempt. \
+
+  This behavior is significant for a Security Operations Center (SOC) to identify, as it can signify a potential attack vector. Malicious actors might use this method to upload a harmful script or other exploitable content to Documentum, thereby establishing a foothold in the environment, spreading malware, or enabling further exploitation. \
+
+  The impact of this behavior, if a true positive, can be quite significant. An attacker could compromise the Documentum application, manipulate or steal sensitive content, and potentially gain unauthorized access to other system resources. An intrusion of this nature could disrupt business operations, result in data breaches, and even damage the organization's reputation. \
+
+  However, it's important to note that false positives may occur. For example, legitimate but uncommon file uploads might match these URL patterns. It's crucial to verify any alerts generated by this analytic to ensure accurate threat detection. This analytic provides critical insights into potential attack attempts and assists in maintaining the integrity and security of enterprise content management systems like Documentum.
+search: '| tstats count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Web where Web.url IN ("/documentum/upload.aspx?parentid=*","*/documentum/upload.aspx?filename=*","*/documentum/upload.aspx?uploadId=*")  Web.http_method=POST 
+  by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
+  | `drop_dm_object_name("Web")`
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` | `citrix_sharefile_exploitation_cve_2023_24489_filter`'
+how_to_implement: This detection requires the Web datamodel to be populated from a
+  supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk
+  for Palo Alto. 
+known_false_positives: False positives may be present, filtering may be needed. Also, restricting to known web servers running IIS or ShareFile will change this from Hunting to TTP.
+references:
+- https://blog.assetnote.io/2023/07/04/citrix-sharefile-rce/
+tags:
+  analytic_story:
+  - Citrix ShareFile RCE CVE-2023-24489
+  cve:
+  - CVE-2023-24489
+  asset_type: Network
+  atomic_guid: []
+  confidence: 50
+  impact: 90
+  message: Possible expliotation of CVE-2023-24489 against $dest$. 
+  mitre_attack_id:
+  - T1190
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  risk_score: 45
+  required_fields:
+  - _time
+  - Web.http_method
+  - Web.url
+  - Web.url_length
+  - Web.src
+  - Web.dest
+  security_domain: Network
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/citrix/citrix-cve202324489.yml
+    source: suricata
+    sourcetype: suricata

From 981ecf1b25c339114021a06a668727adb3af2e4a Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 26 Jul 2023 12:31:16 -0600
Subject: [PATCH 3/8] Update citrix_adc_exploitation_cve_2023_3519.yml

---
 detections/web/citrix_adc_exploitation_cve_2023_3519.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml
index ae8de91722..fa87337691 100644
--- a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml
+++ b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml
@@ -19,9 +19,10 @@ search: '| tstats count min(_time) as firstTime max(_time)
   | `drop_dm_object_name("Web")`
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` | `citrix_adc_exploitation_cve_2023_3519_filter`'
-how_to_implement: This detection requires the Web datamodel to be populated from a
-  supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk
-  for Palo Alto.
+how_to_implement: Dependent upon the placement of the ShareFile application, ensure the latest Technology Add-On is eneabled. This detection requires the Web datamodel to be populated from a
+  supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk
+  for Palo Alto. 
+  The SharFile application is IIS based, therefore ingesting IIS logs and reviewing for the same pattern would identify this activity, successful or not. 
 known_false_positives: False positives may be present based on organization use of SAML utilities. Filter, or restrict the analytic to Citrix devices only.
 references:
 - https://blog.assetnote.io/2023/07/21/citrix-CVE-2023-3519-analysis/

From 562c6941b4316e227f5cfc7f74af500ee5b1a757 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 26 Jul 2023 12:44:19 -0600
Subject: [PATCH 4/8] Update citrix_sharefile_exploitation_cve_2023_24489.yml

---
 detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
index 97d41aeb56..6b568d2e90 100644
--- a/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
+++ b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
@@ -58,6 +58,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/citrix/citrix-cve202324489.yml
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/citrix/citrix-cve_2023_24489.log
     source: suricata
     sourcetype: suricata

From ba3b66fdf1a054e8bbcb4aa72ef8f382c7a40419 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 26 Jul 2023 12:48:17 -0600
Subject: [PATCH 5/8] fixes

---
 .../web/citrix_sharefile_exploitation_cve_2023_24489.yml     | 5 +++--
 stories/citrix_sharefile_rce_cve_2023_24489.yml              | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
index 6b568d2e90..3c7f98ca9e 100644
--- a/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
+++ b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
@@ -19,9 +19,10 @@ search: '| tstats count min(_time) as firstTime max(_time)
   | `drop_dm_object_name("Web")`
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` | `citrix_sharefile_exploitation_cve_2023_24489_filter`'
-how_to_implement: This detection requires the Web datamodel to be populated from a
-  supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk
+how_to_implement: Dependent upon the placement of the ShareFile application, ensure the latest Technology Add-On is eneabled. This detection requires the Web datamodel to be populated from a
+  supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk
   for Palo Alto. 
+  The ShareFile application is IIS based, therefore ingesting IIS logs and reviewing for the same pattern would identify this activity, successful or not. 
 known_false_positives: False positives may be present, filtering may be needed. Also, restricting to known web servers running IIS or ShareFile will change this from Hunting to TTP.
 references:
 - https://blog.assetnote.io/2023/07/04/citrix-sharefile-rce/
diff --git a/stories/citrix_sharefile_rce_cve_2023_24489.yml b/stories/citrix_sharefile_rce_cve_2023_24489.yml
index 0e013d9a75..a895c8cd4f 100644
--- a/stories/citrix_sharefile_rce_cve_2023_24489.yml
+++ b/stories/citrix_sharefile_rce_cve_2023_24489.yml
@@ -3,8 +3,8 @@ id: 10c7e01a-5743-4995-99df-a66f6b5db653
 version: 1
 date: '2023-07-26'
 author: Michael Haag, Splunk
-description: A critical vulnerability has been discovered in ShareFile's Storage Zones Controller software (CVE-2023-24489), used by numerous organizations for file sharing and storage. The vulnerability allows unauthenticated arbitrary file upload and remote code execution due to a cryptographic bug in the software's encryption but lack of authentication system. The risk comes from a failing encryption check, allowing potential cybercriminals to upload malicious files to the server. The bug was found in the Documentum Connector's .aspx files. The security risk has a potentially large impact due to the software's wide use and the sensitivity of the stored data. Citrix has released a security update to address this issue.
-narrative: The ShareFile Storage Zones Controller is a .NET web application running under IIS, which manages the storage of files in ShareFile's system. It was discovered that this software has a critical vulnerability (CVE-2023-24489) in the file upload functionality provided by the Documentum Connector's .aspx files. Specifically, the security flaw lies in the encryption check in the file upload process which could be bypassed, allowing for unauthenticated arbitrary file uploads and remote code execution.
+description: A critical vulnerability has been discovered in ShareFile's Storage Zones Controller software (CVE-2023-24489), used by numerous organizations for file sharing and storage. The vulnerability allows unauthenticated arbitrary file upload and remote code execution due to a cryptographic bug in the software's encryption but lack of authentication system. The risk comes from a failing encryption check, allowing potential cybercriminals to upload malicious files to the server. The bug was found in the Documentum Connector's .aspx files. The security risk has a potentially large impact due to the software's wide use and the sensitivity of the stored data. Citrix has released a security update to address this issue. 
+narrative: The ShareFile Storage Zones Controller is a .NET web application running under IIS, which manages the storage of files in ShareFile's system. It was discovered that this software has a critical vulnerability (CVE-2023-24489) in the file upload functionality provided by the Documentum Connector's .aspx files. Specifically, the security flaw lies in the encryption check in the file upload process which could be bypassed, allowing for unauthenticated arbitrary file uploads and remote code execution. \
 
   The application sets the current principal from a session cookie, but if this is missing, the application continues without authentication. The application uses AES encryption, with CBC mode and PKCS#7 padding. A decryption check is in place which returns an error if the decryption fails, but this can be bypassed by supplying a ciphertext that results in valid padding after decryption, thereby not causing an exception. \
 

From ee1e06bdaea3b7d124d33134413e476366ecca3d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 26 Jul 2023 12:48:48 -0600
Subject: [PATCH 6/8] woops

---
 detections/web/citrix_adc_exploitation_cve_2023_3519.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml
index fa87337691..ae8de91722 100644
--- a/detections/web/citrix_adc_exploitation_cve_2023_3519.yml
+++ b/detections/web/citrix_adc_exploitation_cve_2023_3519.yml
@@ -19,10 +19,9 @@ search: '| tstats count min(_time) as firstTime max(_time)
   | `drop_dm_object_name("Web")`
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` | `citrix_adc_exploitation_cve_2023_3519_filter`'
-how_to_implement: Dependent upon the placement of the ShareFile application, ensure the latest Technology Add-On is eneabled. This detection requires the Web datamodel to be populated from a
-  supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk
-  for Palo Alto. 
-  The SharFile application is IIS based, therefore ingesting IIS logs and reviewing for the same pattern would identify this activity, successful or not. 
+how_to_implement: This detection requires the Web datamodel to be populated from a
+  supported Technology Add-On like Splunk for Apache, Splunk for Nginx, or Splunk
+  for Palo Alto.
 known_false_positives: False positives may be present based on organization use of SAML utilities. Filter, or restrict the analytic to Citrix devices only.
 references:
 - https://blog.assetnote.io/2023/07/21/citrix-CVE-2023-3519-analysis/

From 5812a9bc7372d71329d769874dbeb0835bb852e8 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 26 Jul 2023 12:49:55 -0600
Subject: [PATCH 7/8] Update citrix_sharefile_rce_cve_2023_24489.yml

---
 stories/citrix_sharefile_rce_cve_2023_24489.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/stories/citrix_sharefile_rce_cve_2023_24489.yml b/stories/citrix_sharefile_rce_cve_2023_24489.yml
index a895c8cd4f..cf117e8e58 100644
--- a/stories/citrix_sharefile_rce_cve_2023_24489.yml
+++ b/stories/citrix_sharefile_rce_cve_2023_24489.yml
@@ -16,7 +16,8 @@ references:
 - https://blog.assetnote.io/2023/07/04/citrix-sharefile-rce/
 tags:
   analytic_story: Citrix ShareFile RCE CVE-2023-24489
-  category: []
+  category:
+    - Adversary Tactics
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

From 95e0fc2b1ac04ee9a7566f21312863b99542bb83 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 26 Jul 2023 13:37:34 -0600
Subject: [PATCH 8/8] Update citrix_sharefile_exploitation_cve_2023_24489.yml

---
 .../web/citrix_sharefile_exploitation_cve_2023_24489.yml      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
index 3c7f98ca9e..a0f0fb1d1f 100644
--- a/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
+++ b/detections/web/citrix_sharefile_exploitation_cve_2023_24489.yml
@@ -14,11 +14,11 @@ description: The following analytic detects a potentially malicious file upload
 
   However, it's important to note that false positives may occur. For example, legitimate but uncommon file uploads might match these URL patterns. It's crucial to verify any alerts generated by this analytic to ensure accurate threat detection. This analytic provides critical insights into potential attack attempts and assists in maintaining the integrity and security of enterprise content management systems like Documentum.
 search: '| tstats count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Web where Web.url IN ("/documentum/upload.aspx?parentid=*","*/documentum/upload.aspx?filename=*","*/documentum/upload.aspx?uploadId=*")  Web.http_method=POST 
+  as lastTime from datamodel=Web where Web.url="/documentum/upload.aspx?*" AND Web.url IN ("*parentid=*","*filename=*","*uploadId=*") AND Web.url IN ("*unzip=*", "*raw=*") Web.http_method=POST 
   by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype
   | `drop_dm_object_name("Web")`
   | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` | `citrix_sharefile_exploitation_cve_2023_24489_filter`'
+  | `security_content_ctime(lastTime)`| `citrix_sharefile_exploitation_cve_2023_24489_filter`'
 how_to_implement: Dependent upon the placement of the ShareFile application, ensure the latest Technology Add-On is eneabled. This detection requires the Web datamodel to be populated from a
   supported Technology Add-On like Suricata, Splunk for Apache, Splunk for Nginx, or Splunk
   for Palo Alto.