CVE-2026-47413: PraisonAI Platform Unauthorized Workspace Owner Privilege Escalation

union AzureDiagnostics, AppServiceHTTPLogs, W3CIISLog
| where TimeGenerated > ago(24h)
| where RequestUri has "/workspaces/" and RequestUri has "/members"
| where RequestMethod == "POST"
| extend WorkspaceId = extract(@"/workspaces/([^/]+)/members", 1, RequestUri)
| extend RequestBodyStr = tostring(RequestBody)
| where RequestBodyStr has "owner" or RequestBodyStr has "role"
| project TimeGenerated, CallerIpAddress, RequestUri, WorkspaceId, UserAgent, RequestBodyStr, ResultCode
| extend SuspiciousRoleAssignment = iff(ResultCode in (200, 201), true, false)
| where SuspiciousRoleAssignment == true
| summarize AttemptCount = count(), UniqueTargetWorkspaces = dcount(WorkspaceId) by CallerIpAddress, bin(TimeGenerated, 5m)
| where AttemptCount >= 1

index=web_logs OR index=app_logs
| search uri="*/workspaces/*/members" method=POST
| rex field=uri "/workspaces/(?P<workspace_id>[^/]+)/members"
| rex field=request_body "\"role\"\s*:\s*\"(?P<assigned_role>[^\"]+)\""
| rex field=request_body "\"user_id\"\s*:\s*\"(?P<target_user>[^\"]+)\""
| where status IN (200, 201)
| where assigned_role="owner" OR assigned_role="admin"
| eval is_suspicious=if(isnull(assigned_role) OR assigned_role="owner", 1, 0)
| where is_suspicious=1
| stats count AS attempt_count, dc(workspace_id) AS unique_workspaces, values(target_user) AS target_users BY src_ip, user, _time span=5m
| where attempt_count >= 1
| sort -attempt_count

sequence by source.ip with maxspan=10m
  [network where event.dataset == "http" and http.request.method == "POST"
    and url.path : "/workspaces/*/members"
    and http.response.status_code in (200, 201)
    and (http.request.body.content : "*owner*" or http.request.body.content : "*\"role\"*")]
  [network where event.dataset == "http" and http.request.method == "GET"
    and url.path : "/workspaces/*/members"
    and http.response.status_code == 200]

SELECT sourceip, username, URL, "HTTP Method", "HTTP Response Code", PAYLOAD, LOGSOURCENAME(logsourceid) AS LogSource, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Microsoft IIS')
  AND "HTTP Method" = 'POST'
  AND URL MATCHES '.*\/workspaces\/[^\/]+\/members.*'
  AND "HTTP Response Code" IN ('200', '201')
  AND (PAYLOAD ILIKE '%owner%' OR PAYLOAD ILIKE '%"role"%')
  AND starttime > NOW() - 3600000
ORDER BY starttime DESC
LIMIT 500

_sourceCategory=web/access OR _sourceCategory=application/logs
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| parse regex "POST (?P<uri>/workspaces/[^/]+/members)"
| parse regex "\"role\":\s*\"(?P<role>[^\"]+)\""
| parse regex "\"user_id\":\s*\"(?P<target_user>[^\"]+)\""
| where !(isNull(uri))
| where role = "owner"
| json field=_raw "status_code" as http_status nodrop
| where http_status in ("200", "201")
| count by src_ip, role, target_user, uri
| sort by _count desc

rule cve_2026_47413_praisonai_owner_escalation {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects CVE-2026-47413 exploitation: unauthorized owner assignment in PraisonAI Platform"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-8g2p-pqm3-fcfh"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = "POST"
    re.regex($http.network.http.request_url, `/workspaces/[^/]+/members`)
    $http.network.http.response_code in (200, 201)
    (
      re.regex($http.network.http.request_body, `"role"\s*:\s*"owner"`) or
      re.regex($http.network.http.request_body, `"role"\s*:\s*"admin"`)
    )
    $http.principal.ip = $src_ip

  condition:
    $http
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=HttpRequest
| ProcessName != null
| HttpRequestUri = /\/workspaces\/[^\/]+\/members/
| HttpMethod = "POST"
| HttpStatusCode in [200, 201]
| (HttpRequestBody = /\"role\"\s*:\s*\"owner\"/ OR HttpRequestBody = /\"role\"\s*:\s*\"admin"/)
| groupBy([RemoteAddressIP4, UserName, HttpRequestUri, HttpStatusCode], function=[count(as=attempt_count), collect(HttpRequestBody)])
| sort(attempt_count, order=desc)