CVE-2026-48753: Incus S3 Multipart Upload Path Traversal Arbitrary File Write

let TraversalPatterns = dynamic(['../', '..\\', '%2e%2e%2f', '%2e%2e/', '..%2f', '%2e%2e%5c']);
union
(
    DeviceFileEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName in~ ('incusd', 'incus')
    | where FolderPath !startswith '/var/lib/incus/storage-pools/'
        and FolderPath !startswith '/var/lib/incus/containers/'
    | where ActionType in ('FileCreated', 'FileModified')
    | project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
    | extend AlertReason = 'Incus process wrote file outside expected storage paths'
),
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName in~ ('incusd')
    | where RemotePort in (443, 9000, 9001)
    | extend RequestDetails = tostring(AdditionalFields)
    | where RequestDetails has_any (TraversalPatterns)
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessCommandLine, RequestDetails
    | extend AlertReason = 'Incus S3 request contains path traversal sequence'
),
(
    Syslog
    | where TimeGenerated > ago(24h)
    | where ProcessName == 'incusd'
    | where SyslogMessage has_any (TraversalPatterns)
        or SyslogMessage has 'multipart'
    | where SyslogMessage has_any (TraversalPatterns)
    | project TimeGenerated, HostName, ProcessName, SyslogMessage
    | extend AlertReason = 'Incus daemon log contains path traversal in S3 multipart context'
)
| summarize count() by AlertReason, DeviceName, bin(TimeGenerated, 5m)
| where count_ > 0

index=linux sourcetype IN (syslog, linux_secure, osquery_differential)
(
  (
    (process_name="incusd" OR process="incusd")
    AND (
      message IN ("*../*", "*..\\*", "*%2e%2e%2f*", "*%2e%2e%5c*", "*%252e%252e*")
      OR (message="*multipart*" AND message IN ("*../*", "*..\\*"))
    )
  )
  OR
  (
    sourcetype="osquery_differential"
    AND name="file_events"
    AND columns.process_name="incusd"
    AND NOT (
      columns.target_path LIKE "/var/lib/incus/storage-pools/%"
      OR columns.target_path LIKE "/var/lib/incus/containers/%"
      OR columns.target_path LIKE "/run/incus/%"
    )
  )
)
| eval traversal_detected=if(match(message, "(\.\./|%2e%2e%2f|%2e%2e/|%252e%252e)"), "yes", "no")
| eval file_outside_storage=if(sourcetype="osquery_differential" AND NOT match('columns.target_path', "^/var/lib/incus/"), "yes", "no")
| eval risk_score=case(
    traversal_detected="yes" AND file_outside_storage="yes", 100,
    traversal_detected="yes", 80,
    file_outside_storage="yes", 70,
    true(), 50
  )
| where risk_score >= 70
| table _time, host, process_name, message, traversal_detected, file_outside_storage, risk_score
| sort -risk_score

sequence by host.name with maxspan=2m
  [
    network where process.name == "incusd"
      and (
        url.path like~ "*../*"
        or url.path like~ "*%2e%2e%2f*"
        or url.path like~ "*%2e%2e/*"
        or url.query like~ "*../*"
      )
      and (
        destination.port == 443
        or destination.port == 9000
        or destination.port == 9001
      )
  ] by process.pid
  [
    file where process.name == "incusd"
      and event.action in ("creation", "overwrite")
      and not (
        file.path like "/var/lib/incus/storage-pools/*"
        or file.path like "/var/lib/incus/containers/*"
        or file.path like "/run/incus/*"
        or file.path like "/tmp/incus*"
      )
  ] by process.pid

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  "Process Name",
  "File Path",
  QIDNAME(qid) AS event_name,
  logsourcename(logsourceid) AS log_source,
  magnitude
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Linux Syslog', 'SentinelOne', 'CrowdStrike Falcon')
  AND (
    (
      "Process Name" ILIKE '%incusd%'
      AND (
        UTF8(payload) ILIKE '%../%'
        OR UTF8(payload) ILIKE '%2e%2e%2f%'
        OR UTF8(payload) ILIKE '%2e%2e/%'
        OR UTF8(payload) ILIKE '%252e252e%'
      )
    )
    OR (
      "Process Name" ILIKE '%incusd%'
      AND "File Path" IS NOT NULL
      AND "File Path" NOT ILIKE '/var/lib/incus/%'
      AND "File Path" NOT ILIKE '/run/incus/%'
      AND "File Path" NOT ILIKE '/tmp/%'
      AND category = 18
    )
  )
  AND LAST 24 HOURS
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=linux/syslog OR _sourceCategory=endpoint/file_events OR _sourceCategory=audit/auditd
| where _sourceCategory matches "*incus*" or process_name matches "incusd"
| parse field=message "*" as raw_message nodrop
| if(raw_message matches "*../*" or raw_message matches "*%2e%2e%2f*" or raw_message matches "*%2e%2e/*" or raw_message matches "*%252e%252e*", true, false) as has_traversal
| if(_sourceCategory = "endpoint/file_events" and !(file_path matches "/var/lib/incus/*" or file_path matches "/run/incus/*"), true, false) as file_outside_incus
| where has_traversal or file_outside_incus
| eval risk = if(has_traversal and file_outside_incus, "CRITICAL", if(has_traversal, "HIGH", "MEDIUM"))
| count by _sourceHost, process_name, risk, has_traversal, file_outside_incus
| where _count > 0
| order by risk, _count desc

rule cve_2026_48753_incus_path_traversal {
  meta:
    author = "df00tech Detection Platform"
    description = "Detects CVE-2026-48753 Incus S3 multipart upload path traversal exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/lxc/incus/security/advisories/GHSA-ccjc-4qc3-jxqc"
    cve = "CVE-2026-48753"
    created = "2026-06-27"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH" OR
    $e.metadata.event_type = "FILE_CREATION" OR
    $e.metadata.event_type = "NETWORK_HTTP"

    $e.principal.process.file.full_path = /incusd$/

    (
      $e.network.http.request.url = /(\.\.\/|%2e%2e%2f|%2e%2e\/|%252e%252e)/i OR
      (
        $e.target.file.full_path != "/var/lib/incus/" AND
        $e.metadata.event_type = "FILE_CREATION"
      )
    )

  condition:
    $e
}

#repo=base_sensor_events #category=FileWrittenEvent
| filter (ImageFileName=/\/incusd$/ OR ParentBaseFileName="incusd")
| filter NOT (
    TargetFileName STARTS WITH "/var/lib/incus/storage-pools/" OR
    TargetFileName STARTS WITH "/var/lib/incus/containers/" OR
    TargetFileName STARTS WITH "/run/incus/" OR
    TargetFileName STARTS WITH "/tmp/incus"
  )
| eval risk_indicator = "file_write_outside_incus_storage"
| join type=left
  (
    #repo=base_sensor_events #category=NetworkConnectIP4
    | filter ImageFileName=/\/incusd$/
    | filter RemotePort IN (443, 9000, 9001, 8080)
    | eval risk_indicator = "s3_network_connection"
    | fields ProcessStartTime, aid, ContextProcessId, RemoteIP, RemotePort
  )
  aid, ContextProcessId
| stats count() AS event_count, values(TargetFileName) AS affected_files,
        values(RemoteIP) AS remote_ips, values(RemotePort) AS remote_ports
    by aid, UserName, ImageFileName, bin(timestamp, 5m)
| where event_count > 0
| sort -event_count