CVE-2026-53633: Vitest Browser Mode API RCE via CDP Proxy and Config Overwrite

let VitestPorts = dynamic([51204, 51205, 5173, 5174, 4173]);
let SuspiciousCDPPaths = dynamic(["/json", "/__vitest_api__", "/__vitest__", "/cdp", "/ws"]);
union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated >= ago(24h)
| where (DeviceAction !in ("blocked", "deny") or isempty(DeviceAction))
| where (
    (RemotePort in (VitestPorts)) or
    (DestinationPort in (VitestPorts))
  )
| extend RequestPath = tostring(parse_url(RequestURL)["Path"])
| where RequestPath has_any (SuspiciousCDPPaths) or RequestURL has_any (SuspiciousCDPPaths)
| extend IsExternal = ipv4_is_private(RemoteIP) == false or ipv4_is_private(SourceIP) == false
| extend SuspiciousCDPCommand = RequestURL has_any ("Runtime.evaluate", "Page.navigate", "Target.attachToTarget", "IO.read")
| where IsExternal or SuspiciousCDPCommand
| project TimeGenerated, DeviceName, RemoteIP, DestinationIP, RemotePort, DestinationPort, RequestURL, RequestPath, IsExternal, SuspiciousCDPCommand
| summarize Count=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Paths=make_set(RequestPath, 20) by DeviceName, RemoteIP, DestinationIP
| where Count >= 1
| extend RiskScore = iif(SuspiciousCDPCommand == true or IsExternal == true, "High", "Medium")

index=network OR index=proxy OR index=webserver earliest=-24h
| eval vitest_ports=if(dest_port IN (51204, 51205, 5173, 5174, 4173) OR src_port IN (51204, 51205, 5173, 5174, 4173), 1, 0)
| where vitest_ports=1
| eval cdp_path=if(match(uri_path, "(__vitest_api__|__vitest__|/cdp|/json|/ws)"), 1, 0)
| eval cdp_command=if(match(uri_query, "(Runtime\.evaluate|Page\.navigate|Target\.attachToTarget|IO\.read|Target\.createTarget)"), 1, 0)
| eval config_write=if(match(uri_path, "(\.env|\.config\.(js|ts|mjs)|vitest\.config|vite\.config)"), 1, 0)
| eval src_external=if(NOT match(src_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)"), 1, 0)
| where cdp_path=1 OR cdp_command=1 OR config_write=1 OR src_external=1
| eval risk_score=case(
    cdp_command=1 AND src_external=1, 90,
    cdp_command=1, 75,
    config_write=1, 80,
    src_external=1 AND cdp_path=1, 70,
    true(), 50
  )
| stats count AS request_count, earliest(_time) AS first_seen, latest(_time) AS last_seen, values(uri_path) AS paths, max(risk_score) AS max_risk by src_ip, dest_ip, dest_port
| where request_count >= 1 AND max_risk >= 70
| sort -max_risk

sequence by source.ip with maxspan=5m
  [network where destination.port in (51204, 51205, 5173, 5174, 4173)
   and url.path like~ "*__vitest*" or url.path like~ "*/cdp*" or url.path like~ "*/json"]
  [network where destination.port in (51204, 51205, 5173, 5174, 4173)
   and (url.query like~ "*Runtime.evaluate*"
     or url.query like~ "*Page.navigate*"
     or url.query like~ "*Target.attachToTarget*"
     or url.path like~ "*.config*"
     or url.path like~ "*.env*")]

SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  starttime,
  CATEGORYNAME(category) AS category_name,
  eventcount
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'F5 BIG-IP', 'Palo Alto Networks Firewall')
  AND destinationport IN (51204, 51205, 5173, 5174, 4173)
  AND (
    URL IMATCHES '.*(__vitest_api__|__vitest__|/cdp|/json|/ws).*'
    OR URL IMATCHES '.*(Runtime\.evaluate|Page\.navigate|Target\.attachToTarget|IO\.read).*'
    OR URL IMATCHES '.*\.(env|config\.js|config\.ts|config\.mjs|config\.cjs).*'
  )
  AND NOT INCIDR(sourceip, '10.0.0.0/8')
  AND NOT INCIDR(sourceip, '172.16.0.0/12')
  AND NOT INCIDR(sourceip, '192.168.0.0/16')
  AND DATEFORMAT(starttime, 'YYYY-MM-dd') >= DATEFORMAT(NOW() - 86400000, 'YYYY-MM-dd')
ORDER BY starttime DESC
LIMIT 1000

_sourceCategory=network/proxy OR _sourceCategory=web/access
| where (%"dest_port" in ("51204","51205","5173","5174","4173") or %"destination.port" in ("51204","51205","5173","5174","4173"))
| where (%"uri_path" matches "*__vitest*" or %"uri_path" matches "*/cdp*" or %"uri_path" matches "*/json" or %"url.path" matches "*__vitest*")
| eval cdp_command = if (%"uri_query" matches "*Runtime.evaluate*" or %"uri_query" matches "*Page.navigate*" or %"uri_query" matches "*attachToTarget*", "true", "false")
| eval config_access = if (%"uri_path" matches "*.config.*" or %"uri_path" matches "*.env*", "true", "false")
| eval external_src = if (!(%"src_ip" matches "10.*" or %"src_ip" matches "172.1*" or %"src_ip" matches "172.2*" or %"src_ip" matches "172.3*" or %"src_ip" matches "192.168.*"), "true", "false")
| where cdp_command = "true" or config_access = "true" or external_src = "true"
| count by %"src_ip", %"dest_ip", %"dest_port", cdp_command, config_access, external_src
| sort by _count desc

rule vitest_browser_rce_cve_2026_53633 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-53633 exploitation attempts against Vitest browser mode API"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/vitest-dev/vitest/security/advisories/GHSA-g8mr-85jm-7xhm"

  events:
    $network.metadata.event_type = "NETWORK_HTTP"
    $network.target.port in (51204, 51205, 5173, 5174, 4173)
    (
      re.regex($network.target.url, `.*(__vitest_api__|__vitest__|/cdp|/json/version|/json/list).*`)
      or re.regex($network.network.http.request_url, `.*(__vitest_api__|/cdp|Runtime\.evaluate|Page\.navigate|Target\.attachToTarget).*`)
      or re.regex($network.network.http.request_url, `.*\.(env|config\.(js|ts|mjs|cjs)|vitest\.config).*`)
    )

  condition:
    $network
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkReceiveAcceptIP4
| LocalPort in (51204, 51205, 5173, 5174, 4173) OR RemotePort in (51204, 51205, 5173, 5174, 4173)
| RemoteAddressIP4 != "127.0.0.1" AND RemoteAddressIP4 != "::1"
| NOT cidrmatch("10.0.0.0/8", RemoteAddressIP4)
| NOT cidrmatch("172.16.0.0/12", RemoteAddressIP4)
| NOT cidrmatch("192.168.0.0/16", RemoteAddressIP4)
| join type=inner
  [
    #event_simpleName=ProcessRollup2
    | ImageFileName in ("/usr/bin/node", "/usr/local/bin/node", "node.exe", "node")
    | CommandLine contains "vitest" OR CommandLine contains "@vitest/browser"
  ]
  field=[aid, TargetProcessId]
  with [aid, ContextProcessId]
| rename RemoteAddressIP4 AS external_ip, LocalPort AS vitest_port
| table _time, aid, ComputerName, external_ip, vitest_port, ImageFileName, CommandLine