Crawl4AI AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE

union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated > ago(24h)
| where (RequestURL has "/execute" or RequestURL has "/run" or RequestURL has "/crawl") and (RequestURL has "crawl4ai" or DestinationPort in (11235, 8080, 8000))
| join kind=leftouter (
    DeviceProcessEvents
    | where TimeGenerated > ago(24h)
    | where InitiatingProcessFileName in~ ("python3", "python", "uvicorn", "gunicorn")
    | where ProcessCommandLine has_any ("gi_frame", "f_back", "__globals__", "__builtins__", "os.system", "subprocess", "__import__")
    | project DeviceId, ProcessCommandLine, InitiatingProcessCommandLine, Timestamp
) on DeviceId
| where isnotempty(ProcessCommandLine)
| project TimeGenerated, DeviceId, DeviceName, RequestURL, ProcessCommandLine, InitiatingProcessCommandLine
| extend AlertReason = "Crawl4AI sandbox escape pattern detected via AST frame introspection"

index=* (sourcetype=suricata OR sourcetype=zeek_http OR sourcetype=nginx_access OR sourcetype=docker_logs)
| eval is_crawl4ai_request=if(match(uri, "/(execute|run|crawl|extract)") OR dest_port IN ("11235", "8080", "8000"), 1, 0)
| where is_crawl4ai_request=1
| join type=left dest_ip [
    search index=* sourcetype=syslog ("gi_frame" OR "f_back" OR "__globals__" OR "__builtins__" OR "os.system" OR "__import__" OR "subprocess.Popen")
    | stats count by host, _raw
    | rename host as dest_ip
]
| where isnotnull(_raw)
| table _time, src_ip, dest_ip, uri, status, _raw
| eval alert="CVE-2026-53753: Crawl4AI AST sandbox escape attempt"

sequence by host.name with maxspan=30s
  [network where network.direction == "ingress"
    and url.path : ("/execute", "/run", "/crawl", "/extract")
    and destination.port in (11235, 8080, 8000)]
  [process where process.name in ("python3", "python", "uvicorn", "gunicorn")
    and process.command_line : ("*gi_frame*", "*f_back*", "*__globals__*", "*__builtins__*", "*os.system*", "*subprocess*", "*__import__*")]

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as EventTime,
  sourceip, destinationip, destinationport,
  URL, "username", QIDNAME(qid) as EventName,
  CATEGORYNAME(category) as Category
FROM events
WHERE (destinationport IN (11235, 8080, 8000)
  AND (URL ILIKE '%/execute%' OR URL ILIKE '%/run%' OR URL ILIKE '%/crawl%'))
AND LOGSOURCETYPENAME(devicetype) IN ('Linux OS', 'Docker', 'Nginx', 'Apache HTTP Server')
AND (payload ILIKE '%gi_frame%' OR payload ILIKE '%f_back%' OR payload ILIKE '%__globals__%'
  OR payload ILIKE '%__builtins__%' OR payload ILIKE '%os.system%' OR payload ILIKE '%__import__%')
LAST 24 HOURS

_sourceCategory=docker* OR _sourceCategory=nginx* OR _sourceCategory=python*
| where (_raw matches /\/(execute|run|crawl|extract)/ or _raw matches /:11235|:8080|:8000/)
| if (_raw matches /gi_frame|f_back|__globals__|__builtins__|os\.system|__import__|subprocess/, 1, 0) as sandbox_escape
| where sandbox_escape = 1
| parse "*" as raw_event
| count by _sourceHost, _sourceCategory, raw_event
| sort by _count desc
| fields _sourceHost, _sourceCategory, raw_event, _count

rule crawl4ai_sandbox_escape_cve_2026_53753 {
  meta:
    author = "df00tech"
    description = "Detects CVE-2026-53753 Crawl4AI AST sandbox escape via gi_frame.f_back chain"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-qxjp-w3pj-48m7"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.target.port in (11235, 8080, 8000)
    re.regex($http.target.url, `/(execute|run|crawl|extract)`)
    $http.principal.ip = $src_ip

    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.process.command_line = /gi_frame|f_back|__globals__|__builtins__|os\.system|__import__|subprocess/
    $proc.principal.hostname = $host

  match:
    $src_ip over 5m

  outcome:
    $risk_score = 95
    $alert_name = "CVE-2026-53753: Crawl4AI Pre-Auth RCE via AST Sandbox Escape"

  condition:
    $http and $proc
}

event_simpleName IN ("NetworkReceiveAccept", "ProcessRollup2")
| search event_simpleName="NetworkReceiveAccept" LocalPort IN ("11235", "8080", "8000")
  AND (HttpPath MATCHES "/(execute|run|crawl|extract)")
| join (
    event_simpleName="ProcessRollup2"
    AND ImageFileName IN ("/usr/bin/python3", "/usr/local/bin/python3", "/usr/bin/python")
    AND CommandLine MATCHES "gi_frame|f_back|__globals__|__builtins__|os\.system|__import__|subprocess\.Popen"
  ) on aid
| table ComputerName, aid, LocalPort, HttpPath, CommandLine, ImageFileName, UserName
| eval ThreatLabel="CVE-2026-53753 Crawl4AI RCE Attempt"