CVE-2026-47668: DbGate Unauthenticated RCE via JSON Script Runner

let dbgate_ports = dynamic([3000, 3001, 8080, 8443]);
let suspicious_paths = dynamic(["/script/run", "/script/execute", "/run-script", "/api/script"]);
union DeviceNetworkEvents, W3CIISLog, AzureDiagnostics
| where TimeGenerated > ago(24h)
| where (
    (csUriStem has_any (suspicious_paths) and csMethod == "POST")
    or (RequestUri has_any (suspicious_paths) and HttpMethod == "POST")
    or (Url has_any (suspicious_paths) and RequestMethod == "POST")
  )
| where (
    csUserName == "-" or csUserName == "" or isempty(csUserName)
    or AuthenticatedUser == "" or isempty(AuthenticatedUser)
  )
| extend UserAgent = coalesce(csUserAgent, UserAgent, RequestUserAgent)
| extend SourceIP = coalesce(cIp, CallerIpAddress, ClientIP)
| project TimeGenerated, SourceIP, UserAgent, RequestPath = coalesce(csUriStem, RequestUri, Url), Method = coalesce(csMethod, HttpMethod, RequestMethod), StatusCode = coalesce(scStatus, ResultCode, HttpStatusCode)
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, UserAgent, RequestPath
| where RequestCount >= 1
| extend RiskScore = iif(RequestCount > 5, "High", "Medium")
| project-reorder FirstSeen, LastSeen, SourceIP, RequestPath, RequestCount, RiskScore, UserAgent

index=web OR index=proxy OR index=iis sourcetype=access_combined OR sourcetype=iis OR sourcetype=nginx:access
| search (uri_path="*/script/run*" OR uri_path="*/script/execute*" OR uri_path="*/run-script*" OR uri_path="*/api/script*") method=POST
| eval auth_header=if(isnull(cs_Authorization) OR cs_Authorization="-" OR cs_Authorization="", "none", cs_Authorization)
| where auth_header="none"
| eval status_code=coalesce(status, sc_status)
| stats count AS request_count, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(uri_path) AS paths_accessed, values(status_code) AS response_codes BY src_ip, http_user_agent
| eval risk=case(request_count>10, "critical", request_count>3, "high", true(), "medium")
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| table first_seen, last_seen, src_ip, request_count, paths_accessed, response_codes, risk, http_user_agent
| sort -request_count

sequence by source.ip with maxspan=5m
  [network where event.dataset in ("nginx.access", "apache.access", "iis.access") and
   http.request.method == "POST" and
   (
     url.path like "*/script/run*" or
     url.path like "*/script/execute*" or
     url.path like "*/run-script*" or
     url.path like "*/api/script*"
   ) and
   not (http.request.headers.authorization : "*") and
   not (url.domain : ("localhost", "127.0.0.1"))
  ] with runs=1

SELECT
  sourceip,
  username,
  URL,
  Method,
  "HTTP Status Code",
  "User Agent",
  starttime,
  COUNT(*) AS request_count
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) IN ('Apache HTTP Server', 'IIS', 'Nginx', 'F5 BIG-IP LTM', 'Squid')
  AND Method = 'POST'
  AND (
    URL ILIKE '%/script/run%'
    OR URL ILIKE '%/script/execute%'
    OR URL ILIKE '%/run-script%'
    OR URL ILIKE '%/api/script%'
  )
  AND (username IS NULL OR username = '' OR username = '-')
  AND DATEFORMAT(starttime, 'yyyy-MM-dd') = DATEFORMAT(NOW(), 'yyyy-MM-dd')
GROUP BY sourceip, username, URL, Method, "HTTP Status Code", "User Agent", starttime
ORDER BY request_count DESC
LAST 24 HOURS

_sourceCategory=web/access OR _sourceCategory=proxy/access OR _sourceCategory=iis/access
| parse regex "(?<method>POST|GET|PUT|DELETE|PATCH) (?<uri>\S+)"
| where method = "POST"
| where uri matches "*/script/run*" or uri matches "*/script/execute*" or uri matches "*/run-script*" or uri matches "*/api/script*"
| parse regex "\"Authorization:\\s*(?<auth_header>[^\"]+)\"" nodrop
| where isNull(auth_header) or auth_header = ""
| parse regex "(?<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" as client_ip
| count as request_count by client_ip, uri
| sort by request_count desc
| where request_count > 0
| fields client_ip, uri, request_count

rule cve_2026_47668_dbgate_unauth_rce {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects unauthenticated POST requests to dbgate-serve script runner endpoints (CVE-2026-47668)"
    severity = "CRITICAL"
    confidence = "HIGH"
    reference = "https://github.com/dbgate/dbgate/security/advisories/GHSA-8v3q-9vmx-36vc"
    cve = "CVE-2026-47668"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = "POST"
    (
      re.regex($http.network.http.request_url, `(?i).*/script/(run|execute).*`) or
      re.regex($http.network.http.request_url, `(?i).*/run-script.*`) or
      re.regex($http.network.http.request_url, `(?i).*/api/script.*`)
    )
    not re.regex($http.network.http.request_headers, `(?i)authorization:`)
    $src_ip = $http.principal.ip

  condition:
    $http
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=NetworkConnectIP4
| ImageFileName=/dbgate|node/i
| LocalPort in (3000, 3001, 8080, 8443, 8000)
| join type=inner (
    #event_simpleName=ProcessRollup2
    | ImageFileName=/node(\.exe)?$/i
    | CommandLine=/dbgate|serve/i
    | field [aid, TargetProcessId]
  ) [aid, ContextProcessId=TargetProcessId]
| eval risk="dbgate_network_activity"
| table _time, aid, ComputerName, LocalPort, RemoteAddressIP4, ImageFileName, CommandLine