Formie Hidden Field Default Server-Side Template Injection (CVE-2026-52889)

let SSTIPatterns = dynamic(['{{', '}}', '{%', 'system(', 'exec(', 'passthru(', '_self.env', 'getFilter', 'RCE', 'file_get_contents', 'proc_open']);
W3CIISLog
| where csUriStem has_any ("/actions/formie", "/formie/", "/submit")
| where csMethod == "POST"
| extend DecodedQuery = url_decode(csUriQuery)
| where DecodedQuery has_any (SSTIPatterns) or csUriQuery has_any (SSTIPatterns)
| project TimeGenerated, cIP, csUriStem, csUriQuery, csUserAgent, scStatus
| union (
  AzureDiagnostics
  | where Category == "ApplicationGatewayFirewallLog"
  | where requestUri_s has_any ("/actions/formie", "/formie/")
  | where details_data_s has_any (SSTIPatterns)
  | project TimeGenerated, cIP=clientIp_s, csUriStem=requestUri_s, csUriQuery=details_data_s, csUserAgent="", scStatus=toint(0)
)
| summarize AttemptCount = count(), Payloads = make_set(csUriQuery, 10) by cIP, csUriStem, bin(TimeGenerated, 5m)
| where AttemptCount >= 1

index=web sourcetype IN ("nginx:access", "apache:access", "iis") uri_path IN ("*/actions/formie*", "*/formie/*")
| eval decoded_query=urldecode(uri_query)
| regex decoded_query="(\{\{.*\}\}|\{%.*%\}|_self\.env|system\(|exec\(|passthru\(|proc_open\(|getFilter)"
| eval method=coalesce(method, http_method)
| where method="POST"
| stats count as attempt_count values(decoded_query) as payloads by src_ip, uri_path, _time span=5m
| where attempt_count >= 1

network where event.category == "network" and destination.port in (80, 443, 8080) and
  http.request.method == "POST" and url.path : ("*actions/formie*", "*formie*") and
  (url.query : ("*%7B%7B*", "*{{*", "*_self.env*", "*system(*", "*proc_open(*") or http.request.body.content : ("*{{*", "*_self.env*", "*proc_open(*"))

SELECT sourceip, destinationip, "URL", payload, eventcount
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%HTTP%'
AND ("URL" ILIKE '%actions/formie%' OR "URL" ILIKE '%formie%')
AND (payload ILIKE '%{{%' OR payload ILIKE '%_self.env%' OR payload ILIKE '%system(%' OR payload ILIKE '%proc_open(%' OR payload ILIKE '%getFilter%')
AND UTF8(payload) ILIKE '%POST%'
GROUP BY sourceip, destinationip, "URL", payload
LAST 24 HOURS

_sourceCategory="web/access"
| where method matches "POST"
| where uri matches "*actions/formie*" or uri matches "*formie*"
| parse regex "(?<decoded_query>.*)" 
| where decoded_query matches "*{{*" or decoded_query matches "*_self.env*" or decoded_query matches "*system(*" or decoded_query matches "*proc_open(*" or decoded_query matches "*getFilter*"
| count by src_ip, uri
| where _count >= 1

rule formie_ssti_cve_2026_52889 {
  meta:
    author = "df00tech"
    description = "Detects SSTI exploitation attempts against Formie Hidden field defaults (CVE-2026-52889)"
    severity = "CRITICAL"
    cve = "CVE-2026-52889"
  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = "POST"
    (re.regex($http.target.url, `(?i)(actions/formie|/formie/)`))
    (re.regex($http.network.http.request_url_path_query_params, `(?i)(\{\{|_self\.env|system\(|proc_open\(|getFilter)`) or
     re.regex($http.network.http.response_body, `(?i)(root:x:|uid=\d+\(|SSTI)`))
  condition:
    $http
}

#event_simple_name=ProcessRollup2
| in(field=ParentBaseFileName, values=["php-fpm", "php", "php-cgi", "w3wp.exe", "httpd", "nginx"], ignoreCase=true)
| in(field=FileName, values=["sh", "bash", "cmd.exe", "powershell.exe", "whoami", "id", "curl", "wget", "nc"], ignoreCase=true)
| CommandLine=/(system\(|proc_open\(|passthru\(|getFilter|_self\.env)/i OR CommandLine=/(id;|whoami;|uname -a)/i
| groupBy([ComputerName, ParentBaseFileName, FileName, CommandLine], function=([count(), collect([aid, UserName])]))