CVE-2026-53513: @better-auth/sso Provider Registration SSRF via Unvalidated OIDC Endpoints

let metadataRanges = dynamic(["169.254.169.254", "169.254.170.2", "100.100.100.200"]);
let privateCidrs = dynamic(["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"]);
union isfuzzy=true
(
  DeviceNetworkEvents
  | where InitiatingProcessFileName in~ ("node", "node.exe", "bun", "deno")
  | where ActionType == "ConnectionSuccess"
  | where RemoteUrl has_any ("/.well-known/openid-configuration", "/oauth", "/token", "/userinfo", "/authorize")
     or isnotempty(RemoteIP)
  | extend IsMetadata = RemoteIP in (metadataRanges)
  | extend IsPrivate = ipv4_is_in_any_range(RemoteIP, privateCidrs)
  | where IsMetadata or IsPrivate
  | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, IsMetadata, IsPrivate
)

index=network OR index=proxy sourcetype IN ("stream:http", "pan:traffic", "suricata")
| eval src_app=coalesce(process_name, app)
| search (uri_path="*/.well-known/openid-configuration" OR uri_path="*/token" OR uri_path="*/userinfo" OR uri_path="*/authorize" OR dest_ip="169.254.169.254")
| eval is_metadata=if(dest_ip="169.254.169.254" OR dest_ip="169.254.170.2", 1, 0)
| eval is_private=if(cidrmatch("10.0.0.0/8",dest_ip) OR cidrmatch("172.16.0.0/12",dest_ip) OR cidrmatch("192.168.0.0/16",dest_ip) OR cidrmatch("127.0.0.0/8",dest_ip) OR cidrmatch("169.254.0.0/16",dest_ip), 1, 0)
| where is_metadata=1 OR is_private=1
| stats count min(_time) as firstTime max(_time) as lastTime values(uri_path) as uri_paths by src_ip dest_ip dest_port src_app
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`

sequence by host.id with maxspan=30s
  [ any where process.name in ("node", "bun", "deno") and event.category == "network" and
    (url.path : "*/.well-known/openid-configuration" or url.path : "*/token" or url.path : "*/userinfo") ]
  [ network where process.name in ("node", "bun", "deno") and
    (
      destination.ip == "169.254.169.254" or
      cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16")
    ) ]

SELECT sourceip, destinationip, destinationport, "URL Host" AS urlhost, "URL Path" AS urlpath, QIDNAME(qid) AS event, starttime FROM events WHERE ("URL Path" ILIKE '%/.well-known/openid-configuration' OR "URL Path" ILIKE '%/token' OR "URL Path" ILIKE '%/userinfo' OR "URL Path" ILIKE '%/authorize') AND (destinationip = '169.254.169.254' OR INCIDR('10.0.0.0/8', destinationip) OR INCIDR('172.16.0.0/12', destinationip) OR INCIDR('192.168.0.0/16', destinationip) OR INCIDR('127.0.0.0/8', destinationip) OR INCIDR('169.254.0.0/16', destinationip)) ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*proxy* OR _sourceCategory=*http*
| where (uri_path matches "*/.well-known/openid-configuration" or uri_path matches "*/token" or uri_path matches "*/userinfo" or uri_path matches "*/authorize")
| where (dest_ip = "169.254.169.254"
  or compareCIDRPrefix("10.0.0.0", dest_ip, toInt(8))
  or compareCIDRPrefix("172.16.0.0", dest_ip, toInt(12))
  or compareCIDRPrefix("192.168.0.0", dest_ip, toInt(16))
  or compareCIDRPrefix("127.0.0.0", dest_ip, toInt(8))
  or compareCIDRPrefix("169.254.0.0", dest_ip, toInt(16)))
| count by src_ip, dest_ip, dest_port, uri_path

rule betterauth_sso_ssrf_cve_2026_53513 {
  meta:
    author = "Argus"
    description = "@better-auth/sso SSRF to metadata/private ranges via unvalidated OIDC endpoints (CVE-2026-53513)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    (
      $e.principal.process.file.full_path = /node|bun|deno/ nocase or
      $e.network.http.parsed_user_agent = /node-fetch|undici|axios/ nocase
    )
    (
      re.regex($e.target.url, `/\.well-known/openid-configuration`) or
      re.regex($e.target.url, `/(token|userinfo|authorize)`) 
    )
    (
      $e.target.ip = "169.254.169.254" or
      net.ip_in_range_cidr($e.target.ip, "10.0.0.0/8") or
      net.ip_in_range_cidr($e.target.ip, "172.16.0.0/12") or
      net.ip_in_range_cidr($e.target.ip, "192.168.0.0/16") or
      net.ip_in_range_cidr($e.target.ip, "127.0.0.0/8") or
      net.ip_in_range_cidr($e.target.ip, "169.254.0.0/16")
    )
  condition:
    $e
}

#event_simpleName=/NetworkConnectIP4|DnsRequest/
| ImageFileName=/(node|bun|deno)(\.exe)?$/i
| case {
    RemoteAddressIP4="169.254.169.254" | IsMetadata := "true";
    cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16"]) | IsPrivate := "true";
    * | IsExternal := "true";
  }
| IsMetadata="true" OR IsPrivate="true"
| groupBy([aid, ImageFileName, RemoteAddressIP4, RemotePort], function=count())