Arista VeloCloud Orchestrator SQL Injection (CVE-2026-114625)

let vcoPaths = dynamic(["/portal/", "/login", "/api/", "/enterprise", "/operator", "/sdwan"]);
let sqliPatterns = dynamic(["union select", "union all select", "' or '1'='1", "\" or \"1\"=\"1", "waitfor delay", "pg_sleep", "sleep(", "benchmark(", "information_schema", "';--", "'||'", "extractvalue(", "updatexml(", "convert(int", "@@version", "xp_cmdshell"]);
W3CIISLog
| where csUriStem has_any (vcoPaths) or TargetUrl has_any (vcoPaths)
| extend decodedQuery = tolower(url_decode(coalesce(csUriQuery, "")))
| extend decodedBody = tolower(url_decode(coalesce(column_ifexists("RequestBody", ""), "")))
| where decodedQuery has_any (sqliPatterns) or decodedBody has_any (sqliPatterns)
| project TimeGenerated, cIP, csUriStem, csUriQuery, decodedQuery, scStatus, csUserAgent, sSiteName
| sort by TimeGenerated desc

index=web (uri_path="*/portal/*" OR uri_path="*/api/*" OR uri_path="*/login*" OR uri_path="*enterprise*" OR uri_path="*operator*")
| eval payload=lower(urldecode(uri_query)." ".urldecode(form_data))
| where match(payload, "(union\s+(all\s+)?select|'\s*or\s*'?1'?='?1|waitfor\s+delay|pg_sleep|sleep\(|benchmark\(|information_schema|extractvalue\(|updatexml\(|@@version|xp_cmdshell|';--)")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(uri_path) as paths values(status) as statuses by src_ip, http_user_agent
| where count > 0
| sort - lastSeen

any where event.category == "web" and
  (url.path like~ ("*/portal/*", "*/api/*", "*/login*", "*enterprise*", "*operator*")) and
  (
    stringContains(lower(url.query), "union select") or
    stringContains(lower(url.query), "union all select") or
    stringContains(lower(url.query), "' or '1'='1") or
    stringContains(lower(url.query), "waitfor delay") or
    stringContains(lower(url.query), "pg_sleep") or
    stringContains(lower(url.query), "information_schema") or
    stringContains(lower(url.query), "extractvalue(") or
    stringContains(lower(url.query), "updatexml(") or
    stringContains(lower(url.query), "@@version") or
    stringContains(lower(url.query), "';--")
  )

SELECT sourceip, destinationip, "URL", "UserAgent", "httpResponseCode", QIDNAME(qid) AS eventName, DATEFORMAT(startTime,'yyyy-MM-dd HH:mm:ss') AS time FROM events WHERE ("URL" ILIKE '%/portal/%' OR "URL" ILIKE '%/api/%' OR "URL" ILIKE '%/login%' OR "URL" ILIKE '%enterprise%' OR "URL" ILIKE '%operator%') AND ("URL" ILIKE '%union%select%' OR "URL" ILIKE '%or%1%=%1%' OR "URL" ILIKE '%waitfor delay%' OR "URL" ILIKE '%pg_sleep%' OR "URL" ILIKE '%information_schema%' OR "URL" ILIKE '%extractvalue(%' OR "URL" ILIKE '%updatexml(%' OR "URL" ILIKE '%@@version%' OR "URL" ILIKE '%xp_cmdshell%') ORDER BY startTime DESC LAST 24 HOURS

_sourceCategory=*web* OR _sourceCategory=*proxy*
| parse regex "(?<method>\w+)\s+(?<url>\S+)\s+HTTP" nodrop
| where url matches /.*(\/portal\/|\/api\/|\/login|enterprise|operator).*/
| tolowercase(url) as lurl
| where lurl matches /.*(union\s+(all\s+)?select|'\s*or\s*'?1'?='?1|waitfor\s+delay|pg_sleep|information_schema|extractvalue\(|updatexml\(|@@version|xp_cmdshell|';--).*/
| count by src_ip, url, status_code
| sort by _count desc

rule velocloud_sqli_cve_2026_114625 {
  meta:
    author = "argus"
    description = "SQL injection against Arista VeloCloud Orchestrator (CVE-2026-114625)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($e.network.http.referral_url, `(?i)(/portal/|/api/|/login|enterprise|operator)`) or
      re.regex($e.target.url, `(?i)(/portal/|/api/|/login|enterprise|operator)`)
    )
    re.regex($e.target.url, `(?i)(union\s+(all\s+)?select|'\s*or\s*'?1'?='?1|waitfor\s+delay|pg_sleep|information_schema|extractvalue\(|updatexml\(|@@version|xp_cmdshell|';--)`)
    $ip = $e.principal.ip
  match:
    $ip over 5m
  condition:
    $e
}

#event_simpleName=/.*/ 
| in(event_platform, values=["Lin", "Win"])
| HttpUrl=/(?i)(\/portal\/|\/api\/|\/login|enterprise|operator)/
| HttpUrl=/(?i)(union\s+(all\s+)?select|'\s*or\s*'?1'?='?1|waitfor\s+delay|pg_sleep|information_schema|extractvalue\(|updatexml\(|@@version|xp_cmdshell|';--)/
| groupBy([aid, RemoteAddressIP4, HttpUrl], function=count())
| sort(_count, order=desc)