Gitea Docker REVERSE_PROXY_TRUSTED_PROXIES Wildcard Allows X-WEBAUTH-USER Auth Bypass (CVE-2026-20896)

let TrustedProxyCIDRs = dynamic(["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"]);
W3CIISLog
| where cs_uri_stem has "/user/login" or csUriQuery has "X-WEBAUTH-USER" or cs(X-WEBAUTH-USER) != ""
| extend WebAuthUser = cs(X-WEBAUTH-USER)
| where isnotempty(WebAuthUser)
| where not(ipv4_is_match(c_ip, "10.0.0.0/8") or ipv4_is_match(c_ip, "172.16.0.0/12") or ipv4_is_match(c_ip, "192.168.0.0/16"))
| project TimeGenerated, c_ip, WebAuthUser, cs_uri_stem, cs_User_Agent
| order by TimeGenerated desc

index=web sourcetype=gitea:access ("X-WEBAUTH-USER" OR "X-Webauth-User")
| rex field=_raw "X-WEBAUTH-USER:\s*(?<webauth_user>\S+)"
| where isnotnull(webauth_user)
| eval trusted=if(cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip) OR cidrmatch("192.168.0.0/16",src_ip),"yes","no")
| search trusted=no
| table _time, src_ip, webauth_user, uri_path, http_user_agent
| sort -_time

any where event.dataset == "gitea.access" and http.request.headers.x_webauth_user != null and not cidrmatch(source.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")

SELECT sourceip, "X-WEBAUTH-USER" AS webauthUser, URL, UTF8(payload) AS rawPayload, DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS eventTime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Gitea%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%Web%'
AND UTF8(payload) ILIKE '%X-WEBAUTH-USER%'
AND NOT INCIDR(sourceip,'10.0.0.0/8') AND NOT INCIDR(sourceip,'172.16.0.0/12') AND NOT INCIDR(sourceip,'192.168.0.0/16')
LAST 24 HOURS

_sourceCategory=gitea/access
| parse "X-WEBAUTH-USER: *" as webauth_user
| where !cidr(src_ip, "10.0.0.0/8") and !cidr(src_ip, "172.16.0.0/12") and !cidr(src_ip, "192.168.0.0/16")
| count by src_ip, webauth_user, uri_path
| sort -_count

rule gitea_webauth_user_header_untrusted_source {
  meta:
    author = "detection-engineering"
    description = "Detects X-WEBAUTH-USER header on Gitea requests from untrusted source IP, indicating CVE-2026-20896 exploitation"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.application = "gitea"
    $e.network.http.request_headers["x-webauth-user"] != ""
    not net.ip_in_range_cidr($e.principal.ip, "10.0.0.0/8")
    not net.ip_in_range_cidr($e.principal.ip, "172.16.0.0/12")
    not net.ip_in_range_cidr($e.principal.ip, "192.168.0.0/16")
  condition:
    $e
}

#event_simpleName=HttpRequest AND event_platform=SaaS
| RequestHeaders=/x-webauth-user/i
| in(field=SourceIP, values=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"], mode=cidr, negate=true)
| table([@timestamp, SourceIP, RequestHeaders, RequestURI])