NocoBase myInAppChannels:list SQL Injection to PostgreSQL Superuser RCE (CVE-2026-52887)

let SuspiciousPatterns = dynamic(["COPY ", "PROGRAM", "dblink", "plpythonu", "UNION SELECT", "pg_read_file", "lo_import", "lo_export", "--", "/*", "information_schema"]);
AppServiceHTTPLogs
| where CsUriStem has "/api/myInAppChannels:list"
| where CsUriQuery has "filter"
| extend DecodedQuery = url_decode(CsUriQuery)
| where SuspiciousPatterns has_any (DecodedQuery)
| project TimeGenerated, CIp, CsMethod, CsUriStem, DecodedQuery, ScStatus
| union (
W3CIISLog
| where csUriStem has "/api/myInAppChannels:list"
| where csUriQuery has "filter"
| extend DecodedQuery = url_decode(csUriQuery)
| where SuspiciousPatterns has_any (DecodedQuery)
| project TimeGenerated, CIp=cIP, CsMethod=csMethod, CsUriStem=csUriStem, DecodedQuery, ScStatus=scStatus
)
| sort by TimeGenerated desc

index=web_logs sourcetype=access_combined OR sourcetype=nocobase:app
| search uri_path="*myInAppChannels:list*" uri_query="*filter*"
| eval decoded_query=urldecode(uri_query)
| regex decoded_query="(?i)(COPY\s+.*PROGRAM|dblink|plpythonu|UNION\s+SELECT|pg_read_file|lo_import|lo_export|information_schema|--\s|/\*)"
| table _time, clientip, method, uri_path, decoded_query, status
| sort -_time

sequence by http.client.ip with maxspan=5m
  [network where url.path : "*myInAppChannels:list*" and
    url.query : ("*COPY*PROGRAM*", "*dblink*", "*UNION*SELECT*", "*plpythonu*", "*information_schema*")]
  [network where destination.port == 5432 and event.action == "connection_attempt"]

SELECT sourceip, destinationip, "URL", payload, starttime
FROM events
WHERE "URL" ILIKE '%myInAppChannels:list%'
AND "URL" ILIKE '%filter%'
AND (payload ILIKE '%COPY%PROGRAM%' OR payload ILIKE '%dblink%' OR payload ILIKE '%UNION SELECT%' OR payload ILIKE '%plpythonu%' OR payload ILIKE '%information_schema%' OR payload ILIKE '%pg_read_file%')
AND starttime > NOW() - 7 DAYS
ORDER BY starttime DESC

_sourceCategory=web/access* OR _sourceCategory=nocobase/app*
| parse "* * * [*] \"* * *\" * *" as clientip, ident, user, timestamp, method, uri, protocol, status, bytes
| where uri matches "*myInAppChannels:list*" and uri matches "*filter*"
| urldecode uri as decoded_uri
| where decoded_uri matches "*COPY*PROGRAM*" or decoded_uri matches "*dblink*" or decoded_uri matches "*UNION*SELECT*" or decoded_uri matches "*plpythonu*" or decoded_uri matches "*information_schema*"
| count by clientip, decoded_uri, status
| sort -_count

rule cve_2026_52887_nocobase_sqli {
  meta:
    author = "detection-engineering"
    description = "Detects SQL injection attempts against NocoBase myInAppChannels:list filter (CVE-2026-52887)"
    severity = "CRITICAL"
    cve = "CVE-2026-52887"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /myInAppChannels:list/
    $e.network.http.method = "GET" or $e.network.http.method = "POST"
    re.regex($e.target.url, `(?i)(COPY\s+.*PROGRAM|dblink|plpythonu|UNION\s+SELECT|pg_read_file|lo_import|lo_export|information_schema)`)
  match:
    $e.principal.ip over 5m
  condition:
    $e
}

#event_simpleName=HttpRequest
| RequestURI="*myInAppChannels:list*"
| RequestURI="*filter*"
| RequestURI=/(?i)(COPY.*PROGRAM|dblink|plpythonu|UNION.*SELECT|pg_read_file|information_schema)/
| table([timestamp, ClientIp, RequestURI, ResponseCode, aid])
| sort(timestamp, order=desc)