Apache Camel camel-mongodb-gridfs Header Injection / GridFS Operation Override (CVE-2026-48204)

let SuspiciousHeaders = dynamic(["gridfs.operation", "gridfs.query", "gridfs.filter", "gridfs.$where", "gridfs.delete", "gridfs.remove"]);
AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where CsHost has "camel" or CsUriStem has "gridfs" or CsUriStem has "camel"
| extend HeaderMatches = extract_all(@"(?i)(gridfs\.[a-zA-Z\$]+)\s*[:=]", RequestHeaders)
| where array_length(HeaderMatches) > 0 or RequestHeaders has "$where" or RequestHeaders has "$ne" or RequestHeaders has "$gt" or RequestHeaders has "$regex"
| project TimeGenerated, CIp, CsHost, CsUriStem, RequestHeaders, HeaderMatches, ScStatus
| order by TimeGenerated desc

index=web_proxy OR index=app_logs sourcetype=camel_http
| rex field=_raw "(?i)(?<gridfs_header>gridfs\.[a-zA-Z\$]+)\s*[:=]\s*(?<gridfs_value>[^\r\n&]+)"
| where isnotnull(gridfs_header) OR match(_raw, "(?i)\$where|\$ne|\$gt|\$regex")
| eval nosql_operator_hit=if(match(_raw, "(?i)\$where|\$ne|\$gt|\$regex"), "yes", "no")
| table _time, src_ip, dest_ip, uri_path, gridfs_header, gridfs_value, nosql_operator_hit, status
| sort -_time

network where event.dataset == "http.access" and
  (http.request.headers.gridfs_operation : "*" or
   http.request.headers.gridfs_query : "*" or
   url.path : "*gridfs*") and
  (http.request.body.content : "*\$where*" or http.request.body.content : "*\$ne*" or http.request.body.content : "*\$regex*" or http.request.headers.gridfs_query : "*\$*")

SELECT DATEFORMAT(starttime,'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, destinationip, URL, payload
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%HTTP%'
AND (payload ILIKE '%gridfs.operation%' OR payload ILIKE '%gridfs.query%' OR payload ILIKE '%gridfs.filter%')
AND (payload ILIKE '%$where%' OR payload ILIKE '%$ne%' OR payload ILIKE '%$gt%' OR payload ILIKE '%$regex%')
LAST 24 HOURS

_sourceCategory=web/access
| json field=_raw "headers" as headers nodrop
| where headers matches "*gridfs.*" or _raw matches "*$where*" or _raw matches "*$ne*" or _raw matches "*$regex*"
| parse regex "(?i)(?<gridfs_header>gridfs\.[a-zA-Z\$]+)\s*[:=]\s*(?<gridfs_value>[^&\r\n]+)" nodrop
| count by src_ip, uri_path, gridfs_header, gridfs_value
| sort -_count

rule camel_mongodb_gridfs_header_injection {
  meta:
    author = "df00tech"
    description = "Detects gridfs.* header injection / NoSQL operator abuse against camel-mongodb-gridfs (CVE-2026-48204)"
    severity = "CRITICAL"
  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method != ""
    (
      re.regex($http.target.url, `(?i)gridfs`) or
      re.regex($http.network.http.request_headers, `(?i)gridfs\.[a-zA-Z\$]+`)
    )
    re.regex($http.network.http.request_headers, `(?i)\$where|\$ne|\$gt|\$regex`)
  condition:
    $http
}

#event_simpleName=HttpRequest
| ParsedUrl=/gridfs/i OR RequestHeaders=/gridfs\.[a-zA-Z\$]+/i
| RequestHeaders=/\$where|\$ne|\$gt|\$regex/i OR RequestBody=/\$where|\$ne|\$gt|\$regex/i
| table([Timestamp, ClientIP, ServerIP, ParsedUrl, RequestHeaders])
| sort(Timestamp, order=desc)