Oracle HTTP Server / WebLogic Proxy Plug-in Improper Access Control (CVE-2026-21962)

let sensitivePaths = dynamic(["/console","/wls-wsat","/management","/em","/bea_wls_internal","/wls-exporter","/_async"]);
let bypassMarkers = dynamic(["..","%2e%2e","%252e","%2f","%252f","..;",";/","//","%00"]);
(union isfuzzy=true
    (W3CIISLog
    | project TimeGenerated, csUriStem = csUriStem, csUriQuery = csUriQuery, cIP = cIP, scStatus, csMethod, sSiteName = sSiteName, csUserAgent = csUserAgent),
    (Syslog
    | where ProcessName in ("httpd","OHS","oracle_http_server")
    | extend csUriStem = extract(@"\"[A-Z]+\s+([^\s\?]+)", 1, SyslogMessage), csUriQuery = extract(@"\?([^\s]+)", 1, SyslogMessage), cIP = extract(@"^(\d{1,3}(?:\.\d{1,3}){3})", 1, SyslogMessage), scStatus = extract(@"\"\s(\d{3})\s", 1, SyslogMessage), csMethod = extract(@"\"([A-Z]+)\s", 1, SyslogMessage), csUserAgent = "", sSiteName = HostName)
)
| extend fullUri = strcat(tolower(csUriStem), "?", tolower(csUriQuery))
| where sensitivePaths has_any (fullUri) or fullUri has_any (bypassMarkers)
| where csUriStem has_any (sensitivePaths) or fullUri has_any (bypassMarkers)
| summarize hits = count(), paths = make_set(csUriStem, 20), statuses = make_set(scStatus, 10), firstSeen = min(TimeGenerated), lastSeen = max(TimeGenerated) by cIP, sSiteName
| where hits >= 3
| order by hits desc

index=web (sourcetype=iis OR sourcetype="oracle:ohs:access" OR sourcetype=access_combined)
| eval uri=lower(coalesce(cs_uri_stem, uri_path))
| eval q=lower(coalesce(cs_uri_query, uri_query))
| eval full=uri."?".q
| where (like(uri,"%/console%") OR like(uri,"%/wls-wsat%") OR like(uri,"%/management%") OR like(uri,"%/bea_wls_internal%") OR like(uri,"%/wls-exporter%") OR like(uri,"%/_async%") OR like(uri,"%/em%"))
| eval bypass=if(match(full,"(\.\.|%2e%2e|%252e|\.\.;|;/|//|%2f%2f|%00)"),1,0)
| stats count as hits, values(uri) as paths, values(status) as statuses, min(_time) as firstSeen, max(_time) as lastSeen, sum(bypass) as bypass_hits by src_ip, dest_host
| where hits>=3 OR bypass_hits>=1
| sort - hits

sequence by source.ip with maxspan=5m
  [ any where event.category == "web" and
      (stringContains(url.path, "/console") or stringContains(url.path, "/wls-wsat") or
       stringContains(url.path, "/management") or stringContains(url.path, "/bea_wls_internal") or
       stringContains(url.path, "/wls-exporter") or stringContains(url.path, "/_async")) ]
  [ any where event.category == "web" and
      (stringContains(url.original, "..;") or stringContains(url.original, "%2e%2e") or
       stringContains(url.original, "%252e") or stringContains(url.original, "//")) ]

SELECT sourceip, destinationip, "URL", "httpResponseCode", COUNT(*) AS hits
FROM events
WHERE (LOGSOURCETYPENAME(devicetype) ILIKE '%Apache%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%IIS%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%Oracle%')
AND (LOWER("URL") ILIKE '%/console%' OR LOWER("URL") ILIKE '%/wls-wsat%' OR LOWER("URL") ILIKE '%/management%' OR LOWER("URL") ILIKE '%/bea_wls_internal%' OR LOWER("URL") ILIKE '%/wls-exporter%' OR LOWER("URL") ILIKE '%/_async%')
AND (LOWER("URL") ILIKE '%..;%' OR LOWER("URL") ILIKE '%%2e%2e%' OR LOWER("URL") ILIKE '%//%' OR LOWER("URL") ILIKE '%%2f%2f%')
GROUP BY sourceip, destinationip, "URL", "httpResponseCode"
HAVING hits > 2
ORDER BY hits DESC
LAST 24 HOURS

_sourceCategory=web/* ("/console" OR "/wls-wsat" OR "/management" OR "/bea_wls_internal" OR "/wls-exporter" OR "/_async")
| parse regex "(?<method>[A-Z]+)\s(?<url>\S+)\s" nodrop
| parse regex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| toLowerCase(url) as url_l
| if(url_l matches /(\.\.;|%2e%2e|%252e|\/\/|%2f%2f|%00)/, 1, 0) as bypass
| where url_l matches /.*(\/console|\/wls-wsat|\/management|\/bea_wls_internal|\/wls-exporter|\/_async).*/
| count as hits, sum(bypass) as bypass_hits, values(url_l) as urls by src_ip
| where hits >= 3 or bypass_hits >= 1
| sort by hits desc

rule oracle_ohs_wls_proxy_access_control_bypass_cve_2026_21962 {
  meta:
    author = "Argus Detection Platform"
    description = "Detects access-control bypass against Oracle HTTP Server / WebLogic proxy plug-in (CVE-2026-21962)"
    severity = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-21962"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.target.url, `(?i)/(console|wls-wsat|management|bea_wls_internal|wls-exporter|_async)`)
    re.regex($e.target.url, `(?i)(\.\.;|%2e%2e|%252e|//|%2f%2f|%00)`)
    $ip = $e.principal.ip
  match:
    $ip over 5m
  condition:
    #e >= 3
}

#event_simpleName=/HttpRequest|WebProxy/i
| lower(field=RequestUrl, as=url)
| url=/(\/console|\/wls-wsat|\/management|\/bea_wls_internal|\/wls-exporter|\/_async)/
| bypass := if(regex("(\.\.;|%2e%2e|%252e|\/\/|%2f%2f|%00)", field=url), then=1, else=0)
| groupBy([RemoteAddressIP4, ComputerName], function=[count(as=hits), sum(bypass, as=bypass_hits), collect([url])])
| test(hits >= 3 OR bypass_hits >= 1)
| sort(hits, order=desc)