Crawl4AI Docker API Multiple Critical Vulnerabilities (File Write, SSRF, Auth Bypass, XSS, JS Execution)

let crawl4ai_ports = dynamic([11235, 8080, 8000]);
let ssrf_patterns = dynamic(['/crawl', '/screenshot', '/execute_js', '/extract']);
let traversal_patterns = dynamic(['../', '%2e%2e', '%252e%252e', '..%2f', '..%5c']);
union isfuzzy=true
(
    CommonSecurityLog
    | where TimeGenerated >= ago(24h)
    | where DeviceProduct has_any ('nginx', 'apache', 'haproxy') or ApplicationProtocol == 'HTTP'
    | where DestinationPort in (crawl4ai_ports)
    | where RequestURL has_any (ssrf_patterns)
    | extend ThreatIndicator = case(
        RequestURL has_any (traversal_patterns), 'PathTraversal',
        RequestURL contains 'file://', 'SSRF-FileScheme',
        RequestURL contains '169.254.169.254', 'SSRF-MetadataService',
        RequestURL contains '127.0.0.1', 'SSRF-Loopback',
        RequestURL contains '10.', 'SSRF-PrivateRange',
        RequestURL contains '192.168.', 'SSRF-PrivateRange',
        RequestURL contains 'execute_js', 'JSInjection',
        'SuspiciousRequest'
    )
    | project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, ThreatIndicator, RequestMethod
),
(
    AzureDiagnostics
    | where TimeGenerated >= ago(24h)
    | where ResourceType == 'APPLICATIONGATEWAYS'
    | where requestUri_s has_any (ssrf_patterns)
    | where requestUri_s has_any (traversal_patterns) or httpStatus_d in (200, 201) and requestUri_s has_any (ssrf_patterns)
    | extend ThreatIndicator = 'AppGW-Crawl4AI-Exploit'
    | project TimeGenerated, clientIP_s, requestUri_s, httpStatus_d, ThreatIndicator
)
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), UniqueURLs = dcount(RequestURL) by SourceIP, ThreatIndicator
| where EventCount >= 2
| extend RiskScore = case(ThreatIndicator in ('SSRF-MetadataService', 'SSRF-FileScheme', 'PathTraversal'), 95, ThreatIndicator == 'JSInjection', 85, 70)
| sort by RiskScore desc

index=web OR index=proxy OR index=network sourcetype IN ("access_combined", "nginx:access", "apache:access", "haproxy", "pan:traffic", "cisco:asa")
| where match(uri_path, "(?i)/(?:crawl|screenshot|execute_js|extract|batch|health)")
| eval port_num=coalesce(dest_port, 8080)
| where port_num IN (11235, 8080, 8000, 8001)
| eval threat_type=case(
    match(uri_path, "(?i)(\.\./|%2e%2e|%252e%252e|\.\.%2f)"), "PathTraversal-FileWrite",
    match(uri_query, "(?i)(file://|gopher://|dict://)"), "SSRF-AltScheme",
    match(uri_query, "169\.254\.169\.254"), "SSRF-CloudMetadata",
    match(uri_query, "(?i)(127\.0\.0\.1|localhost|::1)"), "SSRF-Loopback",
    match(uri_query, "(?i)(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01]))"), "SSRF-PrivateRange",
    match(uri_path, "(?i)execute_js"), "JSCodeExecution",
    match(uri_query, "(?i)(<script|javascript:|onerror=|onload=)"), "XSS-Injection",
    true(), "SuspiciousAPICall"
  )
| where isnotnull(threat_type)
| eval auth_header=if(isnull(http_user_agent) OR len(http_authorization)<5, "NoAuth", "HasAuth")
| stats count AS request_count, values(uri_path) AS paths_accessed, values(threat_type) AS threat_types, min(_time) AS first_seen, max(_time) AS last_seen, dc(uri_path) AS unique_paths BY src_ip, dest_ip, auth_header
| where request_count >= 2 OR (request_count >= 1 AND mvcount(threat_types) > 1)
| eval risk_score=case(
    mvfind(threat_types, "SSRF-CloudMetadata") >= 0 OR mvfind(threat_types, "PathTraversal-FileWrite") >= 0, 95,
    mvfind(threat_types, "JSCodeExecution") >= 0, 85,
    true(), 70
  )
| sort - risk_score
| table first_seen, last_seen, src_ip, dest_ip, request_count, unique_paths, threat_types, auth_header, risk_score

sequence by source.ip with maxspan=5m
  [network where event.category == "network" and
   destination.port in (11235, 8080, 8000, 8001) and
   (
     url.path : ("*/crawl*", "*/execute_js*", "*/screenshot*", "*/extract*") or
     url.query : ("*127.0.0.1*", "*169.254.169.254*", "*file://*", "*../.*", "*%2e%2e*")
   )]
  [network where event.category == "network" and
   destination.port in (11235, 8080, 8000, 8001) and
   http.response.status_code in (200, 201, 500) and
   (
     url.path : ("*/execute_js*", "*/crawl*") or
     url.query : ("*10.*", "*192.168.*", "*172.16.*", "*172.17.*")
   )]

SELECT
  sourceip,
  destinationip,
  destinationport,
  URL,
  "Request Method" AS http_method,
  "Response Code" AS http_status,
  COUNT(*) AS event_count,
  MIN(starttime) AS first_seen,
  MAX(starttime) AS last_seen,
  CASE
    WHEN URL ILIKE '%../%' OR URL ILIKE '%..\\%' OR URL ILIKE '%2e2e%' OR URL ILIKE '%252e%' THEN 'PathTraversal'
    WHEN URL ILIKE '%169.254.169.254%' THEN 'SSRF-CloudMetadata'
    WHEN URL ILIKE '%file://%' OR URL ILIKE '%gopher://%' THEN 'SSRF-AltScheme'
    WHEN URL ILIKE '%127.0.0.1%' OR URL ILIKE '%localhost%' THEN 'SSRF-Loopback'
    WHEN URL ILIKE '%execute_js%' THEN 'JSCodeExecution'
    WHEN URL ILIKE '%<script%' OR URL ILIKE '%javascript:%' OR URL ILIKE '%onerror=%' THEN 'XSS'
    WHEN URL ILIKE '%192.168.%' OR URL ILIKE '%10.%' THEN 'SSRF-PrivateRange'
    ELSE 'SuspiciousAPICall'
  END AS threat_type
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'IBM Security Network IPS', 'Juniper Networks')
  AND destinationport IN (11235, 8080, 8000, 8001)
  AND (
    URL ILIKE '%/crawl%'
    OR URL ILIKE '%/execute_js%'
    OR URL ILIKE '%/screenshot%'
    OR URL ILIKE '%/extract%'
    OR URL ILIKE '%169.254.169.254%'
    OR URL ILIKE '%../%'
    OR URL ILIKE '%file://%'
  )
  AND DATEFORMAT(starttime, 'yyyy-MM-dd') >= DATEADD('day', -1, CURRENT_DATE)
GROUP BY sourceip, destinationip, destinationport, URL, http_method, http_status, threat_type
HAVING COUNT(*) >= 1
ORDER BY last_seen DESC

_sourceCategory=web/access OR _sourceCategory=proxy/logs OR _sourceCategory=nginx/access
| parse regex "(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) .+ \"(?<method>\w+) (?<uri>[^\"]+) HTTP/[\d.]+\" (?<status>\d{3})"
| where status matches "[0-9]*"
| where uri matches "*/crawl*" OR uri matches "*/execute_js*" OR uri matches "*/screenshot*" OR uri matches "*/extract*"
| if (uri matches "*../*" OR uri matches "*%2e%2e*" OR uri matches "*%252e*", "PathTraversal",
   if (uri matches "*169.254.169.254*", "SSRF-CloudMetadata",
   if (uri matches "*file://*" OR uri matches "*gopher://*", "SSRF-AltScheme",
   if (uri matches "*127.0.0.1*" OR uri matches "*localhost*", "SSRF-Loopback",
   if (uri matches "*execute_js*", "JSCodeExecution",
   if (uri matches "*<script*" OR uri matches "*javascript:*", "XSS",
   if (uri matches "*192.168.*" OR uri matches "*10.*", "SSRF-PrivateRange", "SuspiciousAPICall"))))))) as threat_type
| count by src_ip, threat_type, uri
| where _count >= 1
| sort by _count desc

rule crawl4ai_exploit_attempt {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2026-56266 Crawl4AI multiple vulnerabilities"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/advisories/GHSA-365w-hqf6-vxfg"
    version = "1.0"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.port in (11235, 8080, 8000, 8001)
    (
      re.regex($e.network.http.request_url, `(?i)/(?:crawl|execute_js|screenshot|extract|batch)`) or
      re.regex($e.network.http.request_url, `(?i)(\.\./|%2e%2e|%252e%252e|file://|gopher://|169\.254\.169\.254)`) or
      re.regex($e.network.http.request_url, `(?i)(<script|javascript:|onerror=|onload=)`)
    )
    $ip = $e.principal.ip

  match:
    $ip over 5m

  outcome:
    $risk_score = max(
      if(re.regex($e.network.http.request_url, `169\.254\.169\.254|file://`), 95,
      if(re.regex($e.network.http.request_url, `execute_js|%2e%2e|\.\./`), 85, 70))
    )
    $threat_type = array_distinct(
      if(re.regex($e.network.http.request_url, `(?i)(\.\./|%2e%2e)`), "PathTraversal",
      if(re.regex($e.network.http.request_url, `169\.254\.169\.254`), "SSRF-CloudMetadata",
      if(re.regex($e.network.http.request_url, `execute_js`), "JSExecution", "Other")))
    )

  condition:
    $e
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=HttpRequest
| CommandLine = /crawl4ai|crawl4ai/
  OR (RemotePort IN [11235, 8080, 8000, 8001] AND
      HttpUrl = /\/(?:crawl|execute_js|screenshot|extract|batch)/i)
| eval ThreatType = case(
    HttpUrl = /(\.\.\/|%2e%2e|%252e)/i, "PathTraversal",
    HttpUrl = /169\.254\.169\.254/, "SSRF-CloudMetadata",
    HttpUrl = /file:\/\/|gopher:\/\//i, "SSRF-AltScheme",
    HttpUrl = /execute_js/i, "JSCodeExecution",
    HttpUrl = /127\.0\.0\.1|localhost/i, "SSRF-Loopback",
    HttpUrl = /<script|javascript:|onerror=/i, "XSS-Injection",
    true, "SuspiciousAPICall"
  )
| where ThreatType != null
| groupBy([aid, RemoteAddressIP4, HttpUrl, ThreatType], function=count(1, as=EventCount))
| where EventCount >= 1
| sort EventCount desc