SunEditor <= 2.47.10 Sanitizer Bypass XSS (CVE-2026-59167)

let xssPatterns = dynamic(["onerror=","onload=","onmouseover=","onfocus=","onpointer","javascript:","<script","<svg","<img","srcdoc=","formaction=","data:text/html","<iframe","onanimationstart"]);
union isfuzzy=true
(
AppServiceHTTPLogs
| extend RawUri = tostring(CsUriStem), Query = tostring(CsUriQuery), UA = tostring(UserAgent)
),
(
W3CIISLog
| extend RawUri = tostring(csUriStem), Query = tostring(csUriQuery), UA = tostring(csUserAgent)
)
| extend Decoded = tolower(url_decode(strcat(RawUri, "?", Query)))
| where Decoded has_any ("suneditor","se-wrapper","sun-editor-editable","/editor","/post","/comment","/content")
| where Decoded has_any (xssPatterns)
| project TimeGenerated, RawUri, Query, UA, Decoded
| sort by TimeGenerated desc

index=web (sourcetype="iis" OR sourcetype="ms:aad:signin" OR sourcetype="access_combined" OR sourcetype="nginx:plus:access")
| eval uri=coalesce(uri_path,cs_uri_stem), q=coalesce(uri_query,cs_uri_query)
| eval decoded=lower(urldecode(uri."?".q))
| where match(decoded,"suneditor|se-wrapper|sun-editor-editable|/editor|/comment|/post|/content")
| where match(decoded,"onerror=|onload=|onmouseover=|onfocus=|onpointer|javascript:|<script|<svg|<img|srcdoc=|formaction=|data:text/html|<iframe|onanimationstart")
| stats count min(_time) as first max(_time) as last values(uri) as uris by src_ip, http_user_agent
| sort - count

any where stringContains(lower(url.original), "suneditor") and
  (stringContains(lower(url.original), "onerror=") or
   stringContains(lower(url.original), "javascript:") or
   stringContains(lower(url.original), "<script") or
   stringContains(lower(url.original), "<svg") or
   stringContains(lower(url.original), "srcdoc=") or
   stringContains(lower(url.original), "formaction=") or
   stringContains(lower(url.original), "onpointer") or
   stringContains(lower(url.original), "onanimationstart"))

SELECT sourceip, url, "User Agent", starttime FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%web%' AND LOWER(url) LIKE '%suneditor%' AND ( LOWER(url) LIKE '%onerror=%' OR LOWER(url) LIKE '%javascript:%' OR LOWER(url) LIKE '%<script%' OR LOWER(url) LIKE '%<svg%' OR LOWER(url) LIKE '%srcdoc=%' OR LOWER(url) LIKE '%formaction=%' OR LOWER(url) LIKE '%onpointer%' OR LOWER(url) LIKE '%onanimationstart%' ) ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*web* OR _sourceCategory=*iis* OR _sourceCategory=*nginx*
| lower(_raw) as raw
| where raw matches "*suneditor*"
| where raw matches "*onerror=*" or raw matches "*javascript:*" or raw matches "*<script*" or raw matches "*<svg*" or raw matches "*srcdoc=*" or raw matches "*formaction=*" or raw matches "*onpointer*" or raw matches "*onanimationstart*"
| parse "* - *" as src_ip, rest nodrop
| count by src_ip
| sort by _count

rule suneditor_cve_2026_59167_xss {
  meta:
    author = "argus"
    description = "SunEditor <= 2.47.10 sanitizer bypass XSS (CVE-2026-59167)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.network.http.referral_url, `(?i)suneditor`) or re.regex($e.target.url, `(?i)suneditor`)
    re.regex($e.target.url, `(?i)(onerror=|javascript:|<script|<svg|srcdoc=|formaction=|onpointer|onanimationstart)`)
  condition:
    $e
}

#event_simpleName=/HttpRequest|NetworkConnect|ProcessRollup2/
| lower(CommandLine) as cl
| lower(HttpUrl) as url
| (url=/suneditor/ OR cl=/suneditor/)
| (url=/onerror=|javascript:|<script|<svg|srcdoc=|formaction=|onpointer|onanimationstart/i OR cl=/suneditor@?2\.(0|1|2|3|4)/)
| groupBy([aid, url, cl], function=count())