Yamcs createInstance instance-template YAML Injection RCE (CVE-2026-55559)

let yamcsPaths = dynamic(["/api/instances", "createInstance", "instance-template"]);
let yamlInjectionMarkers = dynamic(["!!", "!<", "!!javax", "!!java", "!!com.", "!!org.", "ScriptEngine", "tag:yaml.org"]);
union isfuzzy=true
(
  W3CIISLog
  | where csMethod == "POST"
  | where csUriStem has_any (yamcsPaths)
  | extend Payload = strcat(csUriQuery, tostring(csReferer))
  | where Payload has_any (yamlInjectionMarkers)
  | project TimeGenerated, SrcIp = cIP, Method = csMethod, Uri = csUriStem, Query = csUriQuery, Status = scStatus, UserAgent = csUserAgent, Host = Computer
),
(
  CommonSecurityLog
  | where DeviceProduct in ("WAF", "Web Application Firewall", "ApplicationGateway")
  | where RequestMethod == "POST"
  | where RequestURL has_any (yamcsPaths)
  | where AdditionalExtensions has_any (yamlInjectionMarkers) or RequestURL has_any (yamlInjectionMarkers)
  | project TimeGenerated, SrcIp = SourceIP, Method = RequestMethod, Uri = RequestURL, Query = AdditionalExtensions, Status = tostring(SentBytes), UserAgent = DeviceCustomString1, Host = DeviceName
)
| sort by TimeGenerated desc

index=web (sourcetype="iis" OR sourcetype="nginx:plus:kv" OR sourcetype="access_combined")
  method=POST
  (uri_path="*createInstance*" OR uri_path="*/api/instances*" OR uri_query="*instance-template*")
| eval payload=uri_query." ".form_data
| where match(payload, "(!!java|!!javax|!!com\.|!!org\.|!<|ScriptEngine|tag:yaml\.org)")
| stats count min(_time) as firstSeen max(_time) as lastSeen values(uri_path) as uris values(status) as statuses by src_ip host http_user_agent
| convert ctime(firstSeen) ctime(lastSeen)
| sort - count

sequence by host.id with maxspan=5m
  [ network where event.category == "web" and http.request.method == "POST" and
      (url.path : "*createInstance*" or url.path : "*/api/instances*" or url.query : "*instance-template*") and
      (url.query : "*!!java*" or url.query : "*!!javax*" or url.query : "*!!com.*" or url.query : "*ScriptEngine*") ]
  [ process where event.type == "start" and
      process.parent.name : ("java", "java.exe") and
      process.name : ("sh", "bash", "cmd.exe", "powershell.exe", "whoami", "curl", "wget", "nc", "ncat") ]

SELECT sourceip, destinationip, "URL" AS uri, "Request Method" AS method, "User Agent" AS ua, QIDNAME(qid) AS event_name
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Microsoft IIS', 'NGINX')
  AND "Request Method" = 'POST'
  AND ("URL" ILIKE '%createInstance%' OR "URL" ILIKE '%/api/instances%' OR "URL" ILIKE '%instance-template%')
  AND ("URL" ILIKE '%!!java%' OR "URL" ILIKE '%!!javax%' OR "URL" ILIKE '%!!com.%' OR "URL" ILIKE '%ScriptEngine%' OR "URL" ILIKE '%tag:yaml.org%')
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=*web* OR _sourceCategory=*proxy*
| parse regex "(?<method>\w+)\s+(?<uri>\S+)" nodrop
| where method = "POST"
| where uri matches /.*(createInstance|\/api\/instances|instance-template).*/
| where uri matches /.*(!!java|!!javax|!!com\.|!!org\.|ScriptEngine|tag:yaml\.org).*/
| count by src_ip, uri, method
| sort by _count desc

rule yamcs_createinstance_yaml_injection_cve_2026_55559 {
  meta:
    author = "Argus"
    description = "Yamcs createInstance instance-template YAML injection RCE (CVE-2026-55559)"
    severity = "CRITICAL"
    cve = "CVE-2026-55559"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = "POST"
    (
      re.regex($e.target.url, `(?i)(createInstance|/api/instances|instance-template)`)
    )
    re.regex($e.target.url, `(?i)(!!java|!!javax|!!com\.|!!org\.|ScriptEngine|tag:yaml\.org)`)
    $ip = $e.principal.ip
  match:
    $ip over 5m
  condition:
    $e
}

#event_simpleName=ProcessRollup2 event_platform=Lin
| ParentBaseFileName=/^java$/i
| in(field="ImageFileName", values=["*/sh", "*/bash", "*/dash", "*/curl", "*/wget", "*/nc", "*/ncat", "*/whoami", "*/python*", "*/perl"])
| table([timestamp, ComputerName, ParentBaseFileName, ImageFileName, CommandLine, UserName])
| sort(timestamp, order=desc)