SiYuan Attribute View Asset Cell Stored XSS to RCE (CVE-2026-50551)

// Detect suspicious script payloads written to SiYuan attribute view asset cells via kernel API, followed by execution indicators
let suspiciousPatterns = dynamic(["<script","onerror=","onload=","javascript:","<img src=x","document.cookie","fetch(","XMLHttpRequest","eval(","child_process","os/exec","cmd.exe","/bin/sh"]);
let siyuanApiCalls = W3CIISLog
| union (AWSCloudTrail)
| union (Syslog)
| where isnotempty(RequestUrl) or isnotempty(Computer)
| project TimeGenerated, RequestUrl, Computer, csUriStem = coalesce(csUriStem, RequestUrl);
let flaggedRequests = HttpRequest
| where Url has_any ("/api/av/", "/api/attributeView/", "/api/asset/")
| where RequestBody has_any (suspiciousPatterns)
| project TimeGenerated, SourceIP, Url, RequestBody, UserAgent;
flaggedRequests
| join kind=leftouter (
    ProcessCreationEvents
    | where ProcessCommandLine has_any ("curl", "wget", "powershell", "bash -c", "/bin/sh -c", "nc ", "reverse")
    | project TimeGenerated, Computer, ProcessCommandLine
) on $left.TimeGenerated == $right.TimeGenerated
| project TimeGenerated, SourceIP, Url, RequestBody, UserAgent, Computer, ProcessCommandLine
| order by TimeGenerated desc

index=web sourcetype=access_combined OR sourcetype=siyuan_kernel
(uri_path="*/api/av/*" OR uri_path="*/api/attributeView/*" OR uri_path="*/api/asset/*")
| regex _raw="(?i)(<script|onerror=|onload=|javascript:|document\.cookie|eval\(|child_process|os/exec)"
| eval flagged_payload=1
| join type=left max=0 host [
    search index=endpoint sourcetype=sysmon EventCode=1
    (CommandLine="*curl*" OR CommandLine="*wget*" OR CommandLine="*powershell*" OR CommandLine="*bash -c*" OR CommandLine="*/bin/sh -c*" OR CommandLine="*reverse*")
    | rename ComputerName as host
    | table _time host CommandLine
]
| table _time src_ip host uri_path _raw CommandLine
| sort - _time

sequence by host.id with maxspan=10m
  [network where event.action == "http-request" and
     url.path : ("*/api/av/*", "*/api/attributeView/*", "*/api/asset/*") and
     http.request.body.content : ("*<script*", "*onerror=*", "*onload=*", "*javascript:*", "*document.cookie*", "*eval(*")]
  [process where event.type == "start" and
     process.command_line : ("*curl*", "*wget*", "*powershell*", "*bash -c*", "*/bin/sh -c*", "*reverse*")]

SELECT DATEFORMAT(devicetime,'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, "URL", payload
FROM events
WHERE ("URL" ILIKE '%/api/av/%' OR "URL" ILIKE '%/api/attributeView/%' OR "URL" ILIKE '%/api/asset/%')
AND (payload ILIKE '%<script%' OR payload ILIKE '%onerror=%' OR payload ILIKE '%onload=%' OR payload ILIKE '%javascript:%' OR payload ILIKE '%document.cookie%' OR payload ILIKE '%eval(%')
AND devicetime > NOW() - INTERVAL '24' HOURS
ORDER BY devicetime DESC

_sourceCategory=web/access OR _sourceCategory=siyuan/kernel
| where uri_path matches "*api/av*" or uri_path matches "*api/attributeView*" or uri_path matches "*api/asset*"
| where request_body matches "*<script*" or request_body matches "*onerror=*" or request_body matches "*javascript:*" or request_body matches "*document.cookie*" or request_body matches "*eval(*"
| parse regex "(?<src_ip>\d+\.\d+\.\d+\.\d+)"
| count by src_ip, uri_path
| sort -_count

rule siyuan_xss_to_rce_cve_2026_50551 {
  meta:
    author = "df00tech"
    description = "Detects stored XSS payloads against SiYuan attribute view asset cells consistent with CVE-2026-50551 exploitation chained toward RCE"
    severity = "CRITICAL"
    cve = "CVE-2026-50551"
  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.target.url = /.*\/api\/(av|attributeView|asset)\/.*/ nocase
    $http.network.http.method = "POST"
    re.regex($http.network.http.response.body, `(?i)(<script|onerror=|onload=|javascript:|document\.cookie|eval\()`)

    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.target.process.command_line = /.*(curl|wget|powershell|bash -c|reverse).*/ nocase
    $proc.principal.hostname = $http.principal.hostname
  match:
    $http.principal.hostname over 10m
  condition:
    $http and $proc
}

#event_simpleName=HttpRequest
| RequestURI=/.*\/api\/(av|attributeView|asset)\/.*/i
| RequestBody=/(?i)(<script|onerror=|onload=|javascript:|document\.cookie|eval\()/
| join(query={#event_simpleName=ProcessRollup2 | CommandLine=/(?i)(curl|wget|powershell|bash -c|reverse)/}, field=[aid], key=[aid], mode=inner)
| table([timestamp, ComputerName, RequestURI, RequestBody, CommandLine])
| sort(timestamp, order=desc)