kcp front-proxy X-Remote-* Identity Header Injection Impersonation (CVE-2026-61682)

let suspectHeaders = dynamic(["x-remote-user","x-remote-group","x-remote-groups","x-remote-extra-","x-remote-uid"]);
let frontProxyLogs = W3CIISLog
| where csUriStem has_any ("/services/", "/clusters/", "/apis/", "/api/")
| extend hdrs = tolower(tostring(csHeaders))
| where hdrs has_any (suspectHeaders)
| project TimeGenerated, cIP, csUriStem, csMethod, scStatus, csUserName, hdrs, Computer;
frontProxyLogs
| where scStatus in (200, 201, 202, 204)
| extend InjectedSystemMasters = hdrs has "system:masters"
| sort by TimeGenerated desc

index=proxy OR index=kcp sourcetype IN ("kcp:frontproxy:access","nginx:plus:kv","haproxy:http")
| eval hdr_blob=lower(_raw)
| search hdr_blob="*x-remote-*"
| rex field=_raw "(?i)x-remote-group[s]?:\s*(?<injected_groups>[^\r\n\"]+)"
| rex field=_raw "(?i)x-remote-user:\s*(?<injected_user>[^\r\n\"]+)"
| eval sys_masters=if(match(hdr_blob,"system:masters"),1,0)
| where status>=200 AND status<300
| stats count min(_time) as first_seen max(_time) as last_seen values(injected_user) as injected_user values(injected_groups) as injected_groups sum(sys_masters) as sysmasters_hits by src_ip uri_path
| where sysmasters_hits>0 OR count>0
| sort - last_seen

any where http.request.method != null and
  (
    stringContains(lower(http.request.headers), "x-remote-user") or
    stringContains(lower(http.request.headers), "x-remote-group") or
    stringContains(lower(http.request.headers), "x-remote-extra-") or
    stringContains(lower(http.request.headers), "x-remote-uid")
  ) and
  url.path like ("/services/*", "/clusters/*", "/apis/*", "/api/*") and
  http.response.status_code >= 200 and http.response.status_code < 300

SELECT sourceip, url, "httpResponseCode", "httpHeaders", QIDNAME(qid) AS event, starttime
FROM events
WHERE LOWER("httpHeaders") ILIKE '%x-remote-%'
  AND (url ILIKE '/services/%' OR url ILIKE '/clusters/%' OR url ILIKE '/apis/%' OR url ILIKE '/api/%')
  AND "httpResponseCode" BETWEEN 200 AND 299
  AND (LOGSOURCENAME(logsourceid) ILIKE '%kcp%' OR LOGSOURCENAME(logsourceid) ILIKE '%proxy%')
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=*kcp* OR _sourceCategory=*proxy*
| where toLowerCase(_raw) matches "*x-remote-*"
| parse regex "(?i)x-remote-group[s]?:\s*(?<injected_groups>[^\r\n\"]+)" nodrop
| parse regex "(?i)x-remote-user:\s*(?<injected_user>[^\r\n\"]+)" nodrop
| parse regex "\"(?<method>GET|POST|PUT|PATCH|DELETE)\s+(?<uri>[^\s\"]+)" nodrop
| parse regex "\s(?<status>[2-5]\d\d)\s" nodrop
| where status matches "2??"
| where uri matches "/services/*" or uri matches "/clusters/*" or uri matches "/apis/*" or uri matches "/api/*"
| if(toLowerCase(_raw) matches "*system:masters*", 1, 0) as sys_masters
| count by src_ip, uri, injected_user, injected_groups, sys_masters
| sort by _count desc

rule kcp_frontproxy_xremote_header_injection_cve_2026_61682 {
  meta:
    author = "Argus Detection Platform"
    description = "Detects inbound X-Remote-* identity header injection against kcp front-proxy (CVE-2026-61682)"
    cve = "CVE-2026-61682"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex(strings.to_lower($e.network.http.parsed_user_agent, $e.additional.fields["http_headers"]), "x-remote-(user|group|groups|extra-|uid)") or
    re.regex(strings.to_lower($e.additional.fields["http_headers"]), "x-remote-(user|group|groups|extra-|uid)")
    $e.network.http.response_code >= 200
    $e.network.http.response_code < 300
    re.regex($e.target.url, "/(services|clusters|apis|api)/")
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    $e
}

#event_simpleName=/HttpRequest|NetworkHttp/i
| lower(field=http_headers, as=hdrs)
| hdrs=/x-remote-(user|group|groups|extra-|uid)/
| in(field="http_status", values=[200,201,202,204])
| url=/\/(services|clusters|apis|api)\//
| sysmasters := if(hdrs=/system:masters/, then:1, else:0)
| groupBy([src_ip, url], function=[count(as=hits), max(sysmasters, as=sysmasters_flag), collect([hdrs])])
| sort(field=hits, order=desc)