CVE-2026-54658 - @hypequery/clickhouse SQL Injection via Parameter Escaping

let SuspiciousTokens = dynamic(["UNION SELECT","union select","; DROP","; drop","sleep(","SLEEP(","benchmark(","BENCHMARK(","system.tables","system.users","system.processes","xp_cmdshell","information_schema","' OR '1'='1","' or '1'='1"]);
AppServiceHTTPLogs
| where TimeGenerated > ago(1h)
| where CsUriQuery has_any ("clickhouse", "query") or CsUriStem has_any ("clickhouse","query","analytics")
| extend DecodedQuery = url_decode(CsUriQuery)
| where DecodedQuery has_any (SuspiciousTokens)
| project TimeGenerated, CIp, CsUriStem, DecodedQuery, ScStatus, _ResourceId
| union (
  ContainerLogV2
  | where TimeGenerated > ago(1h)
  | where LogMessage has "clickhouse" or LogMessage has "hypequery"
  | where LogMessage has_any (SuspiciousTokens)
  | project TimeGenerated, ContainerId, LogMessage
)
| sort by TimeGenerated desc

index=web_logs OR index=app_logs ("clickhouse" OR "hypequery")
| rex field=_raw "(?<extracted_query>(?i)(union\s+select|;\s*drop|sleep\(|benchmark\(|system\.tables|system\.users|system\.processes|information_schema|'\s*or\s*'1'='1))"
| where isnotnull(extracted_query)
| stats count min(_time) as first_seen max(_time) as last_seen values(extracted_query) as injection_patterns by src_ip, uri_path, host
| where count > 0
| sort -last_seen

sequence by client.ip with maxspan=5m
  [network where destination.port in (8123, 9000) and http.request.body.content : ("*union*select*", "*sleep(*", "*benchmark(*", "*system.tables*", "*'1'='1*")]
  [network where destination.port in (8123, 9000) and event.outcome == "success"]

SELECT sourceip, destinationip, "URL", payload, starttime
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%web%'
AND (UTF8(payload) ILIKE '%union select%'
     OR UTF8(payload) ILIKE '%; drop%'
     OR UTF8(payload) ILIKE '%sleep(%'
     OR UTF8(payload) ILIKE '%benchmark(%'
     OR UTF8(payload) ILIKE '%system.tables%'
     OR UTF8(payload) ILIKE '%information_schema%'
     OR UTF8(payload) ILIKE '%''1''=''1%')
AND ("URL" ILIKE '%clickhouse%' OR "URL" ILIKE '%query%')
LAST 60 MINUTES

_sourceCategory=*webapp* or _sourceCategory=*app*
| where !isNull(_raw)
| parse regex "(?i)(?<injection_pattern>union\s+select|;\s*drop|sleep\(|benchmark\(|system\.tables|system\.users|information_schema|'\s*or\s*'1'='1)" nodrop
| where !isNull(injection_pattern)
| count by injection_pattern, client_ip
| sort -_count

rule cve_2026_54658_hypequery_clickhouse_sqli {
  meta:
    author = "df00tech"
    description = "Detects SQL injection patterns targeting ClickHouse via vulnerable hypequery client (CVE-2026-54658)"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.port = 8123 or $e.target.port = 9000
    $e.network.http.parsed_user_agent.original_string != ""
    re.regex($e.network.http.referral_url, `(?i)(union\s+select|;\s*drop|sleep\(|benchmark\(|system\.tables|information_schema|'\s*or\s*'1'='1)`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2 OR #event_simpleName=NetworkConnectIP4
| ImageFileName=*node* OR ImageFileName=*clickhouse*
| RemotePort=8123 OR RemotePort=9000
| CommandLine=/(?i)(union\s+select|;\s*drop|sleep\(|benchmark\(|system\.tables|information_schema|'\s*or\s*'1'='1)/
| table([ComputerName, ImageFileName, CommandLine, RemoteAddressIP4, RemotePort, timestamp])