Budibase Anonymous NoSQL Operator Injection via Published-App Query Templates

let BudibaseHosts = dynamic([]);
let NoSQLOperators = dynamic(["$gt", "$gte", "$lt", "$lte", "$ne", "$in", "$nin", "$exists", "$where", "$regex", "$elemMatch", "$or", "$and", "$not", "$nor"]);
let lookback = 24h;
union isfuzzy=true
(
  CommonSecurityLog
  | where TimeGenerated >= ago(lookback)
  | where DeviceProduct has_any ("nginx", "apache", "budibase")
  | where RequestURL has "/api/public/v1/queries" or RequestURL has "/app/" 
  | where RequestContext has_any (NoSQLOperators) or AdditionalExtensions has_any (NoSQLOperators)
  | extend InjectionOperator = extract(@"(\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor))", 1, coalesce(RequestContext, AdditionalExtensions))
  | project TimeGenerated, SourceIP, RequestURL, RequestMethod, InjectionOperator, DeviceProduct
),
(
  AzureDiagnostics
  | where TimeGenerated >= ago(lookback)
  | where Category == "ApplicationGatewayAccessLog"
  | where requestUri_s has "/api/public/v1/queries" or requestUri_s has "/api/v1/queries"
  | where requestQuery_s has_any (NoSQLOperators) or Message has_any (NoSQLOperators)
  | extend InjectionOperator = extract(@"(\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor))", 1, coalesce(requestQuery_s, Message))
  | project TimeGenerated, clientIP_s, requestUri_s, httpMethod_s, InjectionOperator
)
| summarize AttemptCount=count(), Operators=make_set(InjectionOperator), RequestPaths=make_set(coalesce(RequestURL, requestUri_s)) by SourceIP=coalesce(SourceIP, clientIP_s), bin(TimeGenerated, 5m)
| where AttemptCount >= 1
| extend RiskScore = case(Operators has "$where", "CRITICAL", array_length(Operators) >= 3, "HIGH", "MEDIUM")
| order by AttemptCount desc

index=web OR index=proxy OR index=waf sourcetype IN ("access_combined", "nginx:access", "apache:access", "pan:traffic", "stream:http")
| eval url=coalesce(uri_path, cs-uri-stem, url, request_url)
| eval body=coalesce(request_body, form_data, postargs, cs-uri-query)
| where match(url, "/api/public/v1/queries|/api/v1/queries|/app/")
| eval nosql_hit=if(match(coalesce(body, url, ""), "\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor)"), 1, 0)
| where nosql_hit=1
| rex field=coalesce(body, url) max_match=10 "(?P<nosql_operator>\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor))"
| stats count as attempt_count, values(nosql_operator) as operators_seen, values(url) as paths_targeted, values(status) as http_statuses, dc(url) as unique_paths by src_ip, _time span=5m
| eval risk_level=case(
    mvcount(operators_seen) > 3, "CRITICAL",
    mvfind(operators_seen, "\$where") >= 0, "CRITICAL",
    mvcount(operators_seen) >= 2, "HIGH",
    1=1, "MEDIUM"
  )
| eval success_indicator=if(mvfind(http_statuses, "200") >= 0, "POSSIBLE_SUCCESS", "ATTEMPTED")
| where attempt_count >= 1
| table _time, src_ip, attempt_count, operators_seen, paths_targeted, risk_level, success_indicator
| sort - risk_level, attempt_count

sequence by source.ip with maxspan=10m
  [network where event.category == "network" and
   (url.path like~ "/api/public/v1/queries*" or url.path like~ "/api/v1/queries*") and
   (http.request.body.content like~ "*\$gt*" or
    http.request.body.content like~ "*\$where*" or
    http.request.body.content like~ "*\$regex*" or
    http.request.body.content like~ "*\$exists*" or
    http.request.body.content like~ "*\$ne*" or
    http.request.body.content like~ "*\$in*" or
    http.request.body.content like~ "*\$nin*" or
    http.request.body.content like~ "*\$or*" or
    url.query like~ "*\$gt*" or
    url.query like~ "*\$where*" or
    url.query like~ "*\$regex*")
  ] with runs=1

SELECT
  sourceip,
  starttime,
  "URL" as request_url,
  "UserAgent" as user_agent,
  REGEXP_EXTRACT("URL", '.*(\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor)).*') as nosql_operator,
  "BytesSent" as response_size,
  "ResponseCode" as http_status,
  CATEGORYNAME(category) as event_category,
  count(*) as event_count
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'NGINX', 'Microsoft IIS') 
  AND (
    "URL" IMATCHES '.*/(api/public/v1/queries|api/v1/queries|app/).*'
    OR PAYLOAD IMATCHES '.*(api/public/v1/queries|api/v1/queries).*'
  )
  AND (
    "URL" MATCHES '.*\$(gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor).*'
    OR PAYLOAD MATCHES '.*\$(gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor).*'
  )
  AND STARTTIME >= NOW() - 3600000
GROUP BY sourceip, starttime, request_url, user_agent, nosql_operator, response_size, http_status, event_category
ORDER BY event_count DESC
LAST 60 MINUTES

_sourceCategory=web/access OR _sourceCategory=proxy OR _sourceCategory=waf
| parse regex "(?P<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" nodrop
| parse regex "\"(?P<http_method>GET|POST|PUT|PATCH|DELETE) (?P<request_path>[^\"]+)\"" nodrop
| parse regex "\b(?P<nosql_op>\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor))\b" multi nodrop
| where request_path matches "/api/public/v1/queries*" or request_path matches "/api/v1/queries*"
| where !isNull(nosql_op)
| timeslice 5m
| stats count as attempt_count, values(nosql_op) as operators_found, values(request_path) as paths by src_ip, _timeslice
| where attempt_count >= 1
| sort by attempt_count desc
| fields _timeslice, src_ip, attempt_count, operators_found, paths

rule budibase_nosql_operator_injection {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects NoSQL operator injection attempts against Budibase published-app query endpoints (CVE-2026-54350)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-8qv3-p479-cj62"
    mitre_attack_tactic = "Initial Access"
    mitre_attack_technique = "T1190"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    (
      re.regex($http.target.url, `/api/public/v1/queries`) or
      re.regex($http.target.url, `/api/v1/queries`)
    )
    (
      re.regex($http.network.http.request_url, `\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor)`) or
      re.regex($http.security_result.summary, `\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor)`)
    )

  condition:
    $http
}

#event_simpleName=HttpRequest
| HttpPath = /api\/(?:public\/)?v1\/queries/
| (HttpQueryString = /\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor)/ OR HttpBodyContent = /\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor)/)
| eval nosql_operator = extract(coalesce(HttpQueryString, HttpBodyContent, ""), /(?P<op>\$(?:gt|gte|lt|lte|ne|in|nin|exists|where|regex|elemMatch|or|and|not|nor))/)
| eval risk = if(nosql_operator = "$where", "CRITICAL", "HIGH")
| groupby([RemoteAddressIP4, HttpPath, nosql_operator, risk], function=[count(aid, as=attempt_count), collect(HttpStatusCode, as=response_codes)])
| sort(attempt_count, order=desc)