PraisonAI Flask API Server Deployed Without Authentication (CVE-2026-47393)

union DeviceNetworkEvents, DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (ActionType == "InboundConnectionAccepted" and LocalPort in (5000, 8000, 8080, 8888) and RemoteIPType != "Private")
   or (FileName in~ ("python.exe", "python3", "python") and ProcessCommandLine has_any ("praisonai", "praison") and ProcessCommandLine has "deploy" and ProcessCommandLine has "api")
| extend RiskSignal = case(
    ProcessCommandLine has "deploy" and ProcessCommandLine has "api", "PraisonAI API deploy detected",
    ActionType == "InboundConnectionAccepted" and RemoteIPType != "Private", "External inbound to Flask port",
    "Unknown"
  )
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, LocalPort, RemoteIP, RemoteIPType, RiskSignal
| order by TimeGenerated desc

index=* sourcetype IN ("WinEventLog:Security", "linux_secure", "osquery:results", "stream:tcp")
| eval is_praisonai_deploy=if(match(cmdline, "(?i)praisonai.*deploy.*api|praison.*--type.*api"), 1, 0)
| eval is_flask_port=if(dest_port IN ("5000", "8000", "8080", "8888") AND NOT match(src_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)"), 1, 0)
| where is_praisonai_deploy=1 OR is_flask_port=1
| eval risk_signal=case(
    is_praisonai_deploy=1, "PraisonAI deploy --type api invoked",
    is_flask_port=1, "External connection to Flask port on PraisonAI host",
    true(), "Unknown"
  )
| table _time, host, user, cmdline, src_ip, dest_port, risk_signal
| sort -_time

sequence by host.name with maxspan=5m
  [process where event.type == "start"
   and process.name in ("python", "python3", "python.exe")
   and process.command_line like~ "*praisonai*deploy*api*"]
  [network where event.type == "connection_accepted"
   and destination.port in (5000, 8000, 8080, 8888)
   and not source.ip like~ "10.*" and not source.ip like~ "192.168.*" and not source.ip like~ "172.1*"]

SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS event_time,
       sourceip, destinationport, username,
       "Process CommandLine" AS cmdline,
       logsourcename(logsourceid) AS log_source
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Linux OS', 'Sysmon')
  AND (
    (LOWER(cmdline) ILIKE '%praisonai%deploy%api%') OR
    (destinationport IN (5000, 8000, 8080, 8888)
     AND NOT (INCIDR('10.0.0.0/8', sourceip) OR INCIDR('172.16.0.0/12', sourceip) OR INCIDR('192.168.0.0/16', sourceip)))
  )
LAST 7 DAYS
ORDER BY starttime DESC

_sourceCategory=*endpoint* OR _sourceCategory=*network*
| parse "cmdline=*" as cmdline nodrop
| parse "dest_port=*" as dest_port nodrop
| parse "src_ip=*" as src_ip nodrop
| where (matches(cmdline, "(?i).*praisonai.*deploy.*api.*"))
   OR (dest_port in ("5000", "8000", "8080", "8888")
       AND !matches(src_ip, "^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\.168\.)"))
| if (matches(cmdline, "(?i).*praisonai.*deploy.*api.*"), "PraisonAI deploy command", "External Flask port hit") as risk_signal
| count by _sourceHost, src_ip, dest_port, cmdline, risk_signal
| order by _count desc

rule praisonai_unauthenticated_api_deploy {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects PraisonAI deploy --type api invocation or external inbound to Flask ports"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8444-4fhq-fxpq"

  events:
    (
      $e.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e.principal.process.command_line, `(?i)praisonai.*deploy.*api`)
    ) or (
      $e.metadata.event_type = "NETWORK_CONNECTION"
      and $e.target.port in (5000, 8000, 8080, 8888)
      and not net.ip_in_range_cidr($e.principal.ip, "10.0.0.0/8")
      and not net.ip_in_range_cidr($e.principal.ip, "172.16.0.0/12")
      and not net.ip_in_range_cidr($e.principal.ip, "192.168.0.0/16")
    )

  condition:
    $e
}

#event_simpleName IN (ProcessRollup2, NetworkConnectIP4)
| where FileName IN ("python.exe", "python3", "python")
  AND (CommandLine LIKE "%praisonai%deploy%api%" OR CommandLine LIKE "%praison%--type%api%")
  OR (#event_simpleName = "NetworkConnectIP4"
      AND LocalPort IN (5000, 8000, 8080, 8888)
      AND NOT cidrMatch(RemoteIP, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"))
| table timestamp, ComputerName, UserName, FileName, CommandLine, LocalPort, RemoteIP
| sort timestamp desc