9router (npm) Unprotected Database Import/Export Leading to Credential Theft and Database Takeover (CVE-2026-55500)

let ExportPaths = dynamic(["/api/export","/api/db/export","/api/database/export","/api/import","/api/db/import","/api/backup","/api/backup/download"]);
let SuspiciousAgents = dynamic(["curl","python-requests","Go-http-client","HTTPie","axios"]);
AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where CsUriStem has_any (ExportPaths)
| extend HasAuthHeader = tostring(parse_json(Cookie))
| where isempty(HasAuthHeader) or UserAgent has_any (SuspiciousAgents)
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Paths = make_set(CsUriStem), Agents = make_set(UserAgent) by CIp
| where RequestCount >= 1
| project CIp, RequestCount, FirstSeen, LastSeen, Paths, Agents

index=web sourcetype=access_combined OR sourcetype=nginx OR sourcetype=apache
| regex uri="(?i)(/api/export|/api/db/export|/api/database/export|/api/import|/api/db/import|/api/backup)"
| eval has_auth=if(match(cookie, "session|auth|token"), 1, 0)
| where has_auth=0 OR match(useragent, "(?i)(curl|python-requests|go-http-client|httpie|axios)")
| stats count as request_count, min(_time) as first_seen, max(_time) as last_seen, values(uri) as paths, values(useragent) as agents by clientip
| where request_count >= 1
| convert ctime(first_seen) ctime(last_seen)

sequence by source.ip with maxspan=5m
  [network where event.dataset == "nginx.access" and url.path : ("*export*", "*import*", "*backup*") and http.request.method in ("GET","POST") and not http.request.headers.authorization : "*"]
  [network where event.dataset == "nginx.access" and http.response.status_code == 200 and http.response.body.bytes > 100000]

SELECT sourceip, destinationip, url, username, UTF8(payload) as payload_text, deviceTime
FROM events
WHERE url ILIKE '%export%' OR url ILIKE '%import%' OR url ILIKE '%backup%'
AND (username IS NULL OR username = '')
AND deviceTime > (NOW() - 86400000)
ORDER BY deviceTime DESC
LIMIT 5000

_sourceCategory=webapp/access
| parse "* * * [*] \"* * *\" * *" as clientip, ident, user, ts, method, uri, proto, status, bytes
| where uri matches "*export*" or uri matches "*import*" or uri matches "*backup*"
| where user matches "-" or user matches ""
| count by clientip, uri, status
| where _count >= 1

rule cve_2026_55500_9router_db_export_exploit {
  meta:
    author = "df00tech"
    description = "Detects unauthenticated access to 9router database export/import endpoints (CVE-2026-55500)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /.*(export|import|backup).*/ nocase
    $e.network.http.method = "GET" or $e.network.http.method = "POST"
    $e.principal.user.userid = "" or $e.principal.user.userid = "-"
  condition:
    $e
}

#event_simpleName=HttpRequest
| in(field="url_path", values=["*export*", "*import*", "*backup*"], ignoreCase=true)
| RequestHeaderAuthorization="" OR RequestHeaderAuthorization=null
| groupBy([ClientIP, url_path], function=([count(), collect([UserAgent])]))
| sort(field="_count", order=desc)