Detect CVE-2026-55166: Lemur ACME SSRF and IDOR Leading to AWS IAM/PKI Compromise in Google Chronicle

rule cve_2026_55166_lemur_ssrf_idor {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects CVE-2026-55166 Lemur ACME SSRF and IDOR exploitation"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/Netflix/lemur/security/advisories/GHSA-v2wp-frmc-5q3v"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    (
      $e.metadata.event_type = "NETWORK_HTTP"
      and (
        re.regex($e.network.http.request_url, `/api/v1/(certificates|authorities|pending_certificates)`)
      )
      and (
        (
          re.regex($e.network.http.request_url, `(acme|challenge|validation)`) and
          re.regex($e.network.http.request_url, `url=`)
        ) or
        re.regex($e.network.http.request_url, `169\.254\.169\.254`) or
        re.regex($e.network.http.request_url, `fd00:ec2`) or
        re.regex($e.network.http.request_url, `metadata\.google\.internal`)
      )
    )
    and $e.principal.ip != ""

  match:
    $e.principal.ip over 10m

  outcome:
    $risk_score = max(
      if(re.regex($e.network.http.request_url, `169\.254\.169\.254`), 95, 0) +
      if(re.regex($e.network.http.request_url, `acme.*url=`), 75, 0)
    )
    $src_ip = array_distinct($e.principal.ip)
    $request_urls = array_distinct($e.network.http.request_url)
    $usernames = array_distinct($e.principal.user.userid)

  condition:
    #e > 1
}