BerriAI LiteLLM SQL Injection Exploitation (CVE-2026-42208)

union DeviceNetworkEvents, CommonSecurityLog, AzureDiagnostics
| where TimeGenerated >= ago(24h)
| where (
    (RequestURL contains "' OR '" or RequestURL contains "' OR 1=1" or RequestURL contains "UNION SELECT" or RequestURL contains "-- " or RequestURL contains "';" or RequestURL contains "%27" or RequestURL contains "0x27")
    or (RequestBody contains "' OR '" or RequestBody contains "UNION SELECT" or RequestBody contains "--" or RequestBody contains "1=1" or RequestBody contains "';--")
  )
| where RequestURL has_any ("/key/", "/user/", "/spend/", "/model/", "/team/", "/health", "/chat/completions")
| extend SuspiciousPayload = coalesce(RequestURL, RequestBody)
| extend ClientIP = coalesce(SourceIP, CallerIpAddress, RemoteIP)
| summarize AttemptCount = count(), DistinctPaths = dcount(RequestURL), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by ClientIP, UserAgent, SuspiciousPayload
| where AttemptCount >= 1
| extend RiskScore = case(AttemptCount > 10, "High", AttemptCount > 3, "Medium", "Low")
| project FirstSeen, LastSeen, ClientIP, UserAgent, AttemptCount, DistinctPaths, SuspiciousPayload, RiskScore
| sort by AttemptCount desc

index=web OR index=proxy OR index=waf sourcetype IN ("access_combined", "nginx:access", "apache:access", "aws:alb:accesslogs", "pan:traffic", "suricata")
| where match(uri_path, "(?i)(key|user|spend|model|team|health|chat\/completions)")
| eval sqli_in_uri=if(match(uri_query, "(?i)('\s*OR\s*'|UNION\s+SELECT|--\s|'\s*;|1=1|0x27|%27)"), 1, 0)
| eval sqli_in_body=if(match(_raw, "(?i)('\s*OR\s*'|UNION\s+SELECT|--\s|'\s*;|1\s*=\s*1)"), 1, 0)
| where sqli_in_uri=1 OR sqli_in_body=1
| stats count AS attempt_count, dc(uri_path) AS distinct_paths, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(uri_path) AS paths_targeted BY src_ip, http_user_agent
| eval risk=case(attempt_count>10, "high", attempt_count>3, "medium", true(), "low")
| sort -attempt_count

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   url.path : ("/key/*", "/user/*", "/spend/*", "/model/*", "/team/*", "/chat/completions") and
   (
     url.query : ("*' OR '*", "*UNION SELECT*", "*--*", "*1=1*", "*%27*", "*0x27*") or
     http.request.body.content : ("*' OR '*", "*UNION SELECT*", "*'--*", "*1=1*")
   )
  ] with runs=1

SELECT sourceip, destinationport, URL, 'HTTP User Agent Header'(payload) AS user_agent, QIDNAME(qid) AS event_name, starttime, payload
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'IBM DataPower Gateway', 'Palo Alto Networks Firewall')
  AND (
    URL IMATCHES '(?i).*(key|user|spend|model|team|chat/completions).*'
  )
  AND (
    URL IMATCHES "(?i).*('+\s*OR\s*'|UNION\s+SELECT|--\s|'\s*;|1=1|0x27|%27).*"
    OR UTF8(payload) IMATCHES "(?i).*('+\s*OR\s*'|UNION\s+SELECT|--\s|';--|1\s*=\s*1).*"
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=web/access OR _sourceCategory=proxy/logs OR _sourceCategory=waf
| where %"cs-uri-stem" matches /\/(key|user|spend|model|team|chat\/completions)\//
| where (
    %"cs-uri-query" matches /(?i)('\s*OR\s*'|UNION\s+SELECT|--\s|%27|0x27|1=1)/
    or _raw matches /(?i)('\s*OR\s*'|UNION\s+SELECT|'\s*;--|1\s*=\s*1)/
  )
| parse regex field=_raw "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| parse regex field=_raw "\"(?<user_agent>[^\"]+)\"\s*$"
| timeslice 1m
| stats count as attempt_count, values(%"cs-uri-stem") as paths by src_ip, user_agent, _timeslice
| where attempt_count >= 1
| sort by attempt_count desc

rule cve_2026_42208_litellm_sqli {
  meta:
    author = "df00tech"
    description = "Detects SQL injection exploitation attempts against BerriAI LiteLLM (CVE-2026-42208)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/BerriAI/litellm/security/advisories/GHSA-r75f-5x8p-qvmc"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.target_url = /\/(key|user|spend|model|team|chat\/completions)\//
    (
      $e.network.http.target_url = /(?i)('\s*OR\s*'|UNION\s+SELECT|--\s|%27|0x27|1=1)/
      or
      $e.network.http.request_body = /(?i)('\s*OR\s*'|UNION\s+SELECT|'\s*;--|1\s*=\s*1)/
    )
    $ip = $e.principal.ip

  match:
    $ip over 5m

  outcome:
    $event_count = count_distinct($e.metadata.id)
    $targeted_paths = array_distinct($e.network.http.target_url)
    $user_agents = array_distinct($e.network.http.user_agent)

  condition:
    #e > 0
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=NetworkConnectIP4
| filter HttpPath in ("/key/", "/user/", "/spend/", "/model/", "/team/", "/chat/completions")
| filter (
    HttpQueryString = ~"(?i)('\s*OR\s*'|UNION SELECT|--\s|%27|0x27|1=1)"
    OR HttpRequestBody = ~"(?i)('\s*OR\s*'|UNION SELECT|'\s*;--|1=1)"
  )
| groupBy([RemoteAddressIP4, HttpUserAgent, HttpPath], function=[count(aid, as=attempt_count), collect(HttpQueryString, as=payloads)])
| sort attempt_count desc
| eval risk_tier = if(attempt_count > 10, "HIGH", if(attempt_count > 3, "MEDIUM", "LOW"))
| select RemoteAddressIP4, HttpUserAgent, HttpPath, attempt_count, payloads, risk_tier