Prebid Server SSRF via Request Forgery (CVE-2026-54735)

// Requires prebid-server container/host network logs ingested (e.g., via AzureDiagnostics, custom table, or Defender for Cloud network flow logs)
let MetadataIps = dynamic(["169.254.169.254"]);
let InternalRanges = dynamic(["10.","172.16.","172.17.","172.18.","172.19.","172.2","172.30.","172.31.","192.168.","127."]);
PrebidServerHttpLogs_CL
| where ProcessName_s has "prebid-server" or Container_s has "prebid-server"
| where isnotempty(DestinationIP_s)
| extend IsMetadata = DestinationIP_s in (MetadataIps)
| extend IsInternal = InternalRanges has_any (pack_array(DestinationIP_s))
| where IsMetadata or IsInternal or RequestPath_s has_any ("/openrtb2/auction","/openrtb2/amp","/setuid","/cookie_sync")
| where RequestPath_s has_any ("/openrtb2/auction","/openrtb2/amp","/setuid","/cookie_sync") and (IsMetadata or IsInternal)
| project TimeGenerated, ProcessName_s, SourceIP_s, DestinationIP_s, RequestPath_s, UserAgent_s, HttpStatusCode_d
| summarize Count=count(), Paths=make_set(RequestPath_s), Destinations=make_set(DestinationIP_s) by SourceIP_s, bin(TimeGenerated, 5m)
| where Count > 1

index=prebid_server sourcetype=prebid:access
| eval is_metadata=if(dest_ip="169.254.169.254",1,0)
| eval is_internal=if(match(dest_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)"),1,0)
| where (is_metadata=1 OR is_internal=1) AND (uri_path="/openrtb2/auction" OR uri_path="/openrtb2/amp" OR uri_path="/setuid" OR uri_path="/cookie_sync")
| stats count values(uri_path) as paths values(dest_ip) as destinations by src_ip, _time span=5m
| where count>1

network where event.dataset == "prebid_server.access" and
  (destination.ip == "169.254.169.254" or
   cidrmatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8")) and
  (url.path == "/openrtb2/auction" or url.path == "/openrtb2/amp" or url.path == "/setuid" or url.path == "/cookie_sync")

SELECT sourceip, destinationip, URL(payload) as request_path, COUNT(*) as event_count
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%prebid%'
AND (destinationip = '169.254.169.254'
  OR INCIDR(destinationip, '10.0.0.0/8')
  OR INCIDR(destinationip, '172.16.0.0/12')
  OR INCIDR(destinationip, '192.168.0.0/16')
  OR INCIDR(destinationip, '127.0.0.0/8'))
AND (payload ILIKE '%/openrtb2/auction%' OR payload ILIKE '%/openrtb2/amp%' OR payload ILIKE '%/setuid%' OR payload ILIKE '%/cookie_sync%')
GROUP BY sourceip, destinationip, request_path
HAVING COUNT(*) > 1
LAST 24 HOURS

_sourceCategory=prebid/server
| where uri_path matches "/openrtb2/auction" or uri_path matches "/openrtb2/amp" or uri_path matches "/setuid" or uri_path matches "/cookie_sync"
| where dest_ip = "169.254.169.254" or dest_ip matches "10.*" or dest_ip matches "172.1[6-9].*" or dest_ip matches "172.2*.*" or dest_ip matches "172.3[01].*" or dest_ip matches "192.168.*" or dest_ip matches "127.*"
| count by src_ip, dest_ip, uri_path
| where _count > 1

rule prebid_server_ssrf_cve_2026_54735 {
  meta:
    author = "df00tech"
    description = "Detects SSRF exploitation of CVE-2026-54735 in prebid-server via requests to metadata/internal IPs from auction/amp/setuid/cookie_sync endpoints"
    severity = "CRITICAL"
    cve = "CVE-2026-54735"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.hostname = /prebid-server|prebid/ nocase
    $e.network.http.method = "POST"
    $e.target.url = /\/openrtb2\/auction|\/openrtb2\/amp|\/setuid|\/cookie_sync/
    ($e.target.ip = "169.254.169.254" or
     $e.target.ip = /^10\./ or
     $e.target.ip = /^172\.(1[6-9]|2[0-9]|3[01])\./ or
     $e.target.ip = /^192\.168\./ or
     $e.target.ip = /^127\./)

  condition:
    $e
}

#event_simpleName=NetworkConnectIP4
| ProcessName=/prebid-server/i
| in(field=RemoteAddressIP4, values=["169.254.169.254"]) OR cidr(field=RemoteAddressIP4, ranges=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8"])
| groupBy([ComputerName, ProcessName, RemoteAddressIP4], function=[count(as=connection_count)])
| test(connection_count > 1)