SiYuan Unauthenticated Arbitrary SQL Execution via searchEmbedBlock (CVE-2026-69084)

let suspiciousSql = dynamic(["insert ","update ","delete ","drop ","alter ","create ","attach ","pragma","union select","select *"," from blocks","1=1","--",";"]);
let embedPaths = dynamic(["/api/search/searchEmbedBlock","searchEmbedBlock"]);
CommonSecurityLog
| where DeviceVendor has_any ("SiYuan", "nginx", "Traefik", "Caddy") or isnotempty(RequestURL)
| where RequestURL has_any (embedPaths) or RequestContext has_any (embedPaths)
| extend BodyLower = tolower(coalesce(column_ifexists("RequestBody", ""), AdditionalExtensions))
| where BodyLower has_any (suspiciousSql)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, RequestMethod, BodyLower, DeviceVendor
| summarize RequestCount=count(), SampleQueries=make_set(BodyLower, 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, RequestURL
| where RequestCount >= 1
| order by RequestCount desc

index=proxy OR index=web sourcetype IN ("nginx:plus:kv","nginx:access","siyuan:access","traefik:access")
(uri_path="*searchEmbedBlock*" OR url="*searchEmbedBlock*")
| eval body=lower(coalesce(form_data, request_body, post_data, http_content))
| where match(body, "(insert |update |delete |drop |alter |attach |pragma|union\s+select|1=1|--|;)")
| stats count as request_count, values(body) as sample_bodies, min(_time) as first_seen, max(_time) as last_seen by src_ip, dest_ip, uri_path, http_method
| where request_count >= 1
| sort - request_count

network where event.category == "web" and
  (url.path : "*searchEmbedBlock*" or url.original : "*searchEmbedBlock*") and
  http.request.body.content : ("*insert *", "*update *", "*delete *", "*drop *", "*attach *", "*pragma*", "*union select*", "*1=1*", "*from blocks*")

SELECT sourceip, destinationip, "URL", "HTTP Method", "Request Body", COUNT(*) AS request_count
FROM events
WHERE ("URL" ILIKE '%searchEmbedBlock%')
  AND (LOWER("Request Body") IMATCHES '.*(insert |update |delete |drop |attach |pragma|union\s+select|1=1|--|;).*')
GROUP BY sourceip, destinationip, "URL", "HTTP Method"
ORDER BY request_count DESC
LAST 24 HOURS

_sourceCategory=*proxy* OR _sourceCategory=*web* OR _sourceCategory=*siyuan*
| where (%"url" matches "*searchEmbedBlock*") or (%"uri_path" matches "*searchEmbedBlock*")
| toLowerCase(field=body) as body_lc
| where body_lc matches /(insert |update |delete |drop |attach |pragma|union\s+select|1=1|--|;)/
| count as request_count, values(body_lc) as sample_bodies by src_ip, dest_ip, url
| where request_count >= 1
| sort by request_count desc

rule siyuan_searchembedblock_sql_exec_cve_2026_69084 {
  meta:
    author = "Argus Detection Platform"
    description = "Unauthenticated arbitrary SQL execution via SiYuan searchEmbedBlock (CVE-2026-69084)"
    severity = "CRITICAL"
    cve = "CVE-2026-69084"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = /POST/ nocase
    re.regex($e.target.url, `(?i)searchEmbedBlock`)
    re.regex($e.network.http.request_body, `(?i)(insert |update |delete |drop |attach |pragma|union\s+select|1=1|--|;)`)
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    $e
}

#event_simpleName=/HttpRequest|NetworkReceiveIP/
| (Url=/searchEmbedBlock/i OR HttpPath=/searchEmbedBlock/i)
| RequestBody := lower(RequestBody)
| RequestBody=/(insert |update |delete |drop |attach |pragma|union\s+select|1=1|--|;)/
| groupBy([aid, RemoteAddressIP4, Url], function=([count(as=request_count), collect([RequestBody])]))
| request_count >= 1
| sort(request_count, order=desc)