Apache DolphinScheduler DataSource API Missing Authorization - Arbitrary Metadata Disclosure (CVE-2026-32966)

union isfuzzy=true
(
    AzureDiagnostics
    | where Category == "ApplicationGatewayAccessLog" or Category == "FrontdoorAccessLog"
    | where requestUri_s matches regex @"/dolphinscheduler/datasources(/list|/verify|/connect|/getById|/queryDataSourceList)" 
    | where httpStatus_s in ("200", "201")
    | project TimeGenerated, CallerIPAddress = clientIP_s, RequestUri = requestUri_s, HttpMethod = httpMethod_s, ResponseCode = httpStatus_s, UserAgent = userAgent_s
),
(
    W3CIISLog
    | where csUriStem matches regex @"/dolphinscheduler/datasources"
    | where scStatus in (200, 201)
    | project TimeGenerated, CallerIPAddress = cIP, RequestUri = csUriStem, HttpMethod = csMethod, ResponseCode = scStatus, UserAgent = csUserAgent
),
(
    CommonSecurityLog
    | where DeviceVendor == "Apache" or ApplicationProtocol == "HTTP"
    | where RequestURL matches regex @"/dolphinscheduler/datasources"
    | where EventOutcome == "200" or EventOutcome == "201"
    | project TimeGenerated, CallerIPAddress = SourceIP, RequestUri = RequestURL, HttpMethod = RequestMethod, ResponseCode = EventOutcome, UserAgent = RequestClientApplication
)
| summarize RequestCount = count(), DistinctEndpoints = dcount(RequestUri), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by CallerIPAddress, UserAgent, bin(TimeGenerated, 5m)
| where RequestCount >= 3 or DistinctEndpoints >= 2
| extend RiskScore = case(
    RequestCount >= 20, "Critical",
    RequestCount >= 10, "High",
    DistinctEndpoints >= 3, "High",
    "Medium"
  )
| project-reorder TimeGenerated, CallerIPAddress, RequestCount, DistinctEndpoints, RiskScore, FirstSeen, LastSeen, UserAgent

index=web OR index=proxy OR index=apache sourcetype IN ("access_combined", "access_combined_wcookie", "iis", "apache:access", "pan:traffic", "squid")
(uri_path="*/dolphinscheduler/datasources*" OR cs_uri_stem="*/dolphinscheduler/datasources*" OR url="*/dolphinscheduler/datasources*")
(status=200 OR status=201 OR sc_status=200 OR sc_status=201)
| eval endpoint=coalesce(uri_path, cs_uri_stem, url),
       src_ip=coalesce(src_ip, c_ip, clientip, src),
       useragent=coalesce(useragent, cs_useragent, http_user_agent),
       method=coalesce(method, cs_method, http_method)
| stats count AS request_count,
        dc(endpoint) AS distinct_endpoints,
        values(endpoint) AS endpoints_accessed,
        values(method) AS methods_used,
        min(_time) AS first_seen,
        max(_time) AS last_seen
  BY src_ip, useragent
| where request_count >= 3 OR distinct_endpoints >= 2
| eval risk_score=case(
    request_count >= 20, "critical",
    request_count >= 10, "high",
    distinct_endpoints >= 3, "high",
    true(), "medium"
  )
| eval duration_seconds=last_seen - first_seen
| sort -request_count
| table src_ip, request_count, distinct_endpoints, endpoints_accessed, methods_used, risk_score, duration_seconds, first_seen, last_seen, useragent

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and event.dataset in ("apache.access", "nginx.access", "iis.access") and
   url.path : "*/dolphinscheduler/datasources*" and
   http.response.status_code in (200, 201)]
  [network where event.category == "network" and event.dataset in ("apache.access", "nginx.access", "iis.access") and
   url.path : "*/dolphinscheduler/datasources*" and
   http.response.status_code in (200, 201)]

SELECT
  sourceip,
  COUNT(*) AS request_count,
  COUNT(DISTINCT "URL") AS distinct_endpoints,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen,
  "User-Agent" AS user_agent
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'Nginx', 'F5 BIG-IP LTM')
  AND ("URL" ILIKE '%/dolphinscheduler/datasources%')
  AND ("responseCode" = '200' OR "responseCode" = '201' OR "responseCode" = 200 OR "responseCode" = 201)
  AND LOGSOURCETIME(starttime) > NOW() - 1 HOURS
GROUP BY
  sourceip,
  "User-Agent"
HAVING
  COUNT(*) >= 3
  OR COUNT(DISTINCT "URL") >= 2
ORDER BY request_count DESC
LAST 60 MINUTES

_sourceCategory=apache OR _sourceCategory=nginx OR _sourceCategory=iis OR _sourceCategory=web/access
| parse regex "(?<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" nodrop
| parse regex "\"(?:GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS) (?<uri_path>[^\" ]+)" nodrop
| parse regex "\"\\s(?<status_code>\\d{3})\\s" nodrop
| where uri_path matches "*/dolphinscheduler/datasources*"
| where status_code in ("200", "201")
| timeslice 5m
| stats count as request_count, dcount(uri_path) as distinct_endpoints, values(uri_path) as accessed_paths by src_ip, _timeslice
| where request_count >= 3 or distinct_endpoints >= 2
| if (request_count >= 20, "critical", if (request_count >= 10, "high", if (distinct_endpoints >= 3, "high", "medium"))) as risk_level
| sort by request_count desc

rule cve_2026_32966_dolphinscheduler_datasource_unauth {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2026-32966 - Apache DolphinScheduler DataSource API missing authorization"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-32966"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.request_url = /\/dolphinscheduler\/datasources/
    $e.network.http.response_code = 200 or
    $e.network.http.response_code = 201
    $ip = $e.principal.ip

  match:
    $ip over 5m

  condition:
    #e >= 3
}

#event_simpleName=NetworkReceiveAcceptIP OR #event_simpleName=NetworkConnectIP
| CommandLine = /dolphinscheduler/
| HttpPath = "*/dolphinscheduler/datasources*"
| HttpStatusCode in (200, 201)
| groupBy([RemoteAddressIP4, HttpPath, HttpStatusCode], function=[
    count(aid, as=request_count),
    min(@timestamp, as=first_seen),
    max(@timestamp, as=last_seen),
    collect(HttpPath, as=endpoints_accessed)
  ])
| where request_count >= 3
| eval risk = if(request_count >= 20, "critical", if(request_count >= 10, "high", "medium"))
| sort(request_count, order=desc)
| select(RemoteAddressIP4, request_count, endpoints_accessed, HttpStatusCode, risk, first_seen, last_seen)