Apache Camel-Atmosphere-Websocket WebSocket Dispatch Header Injection (CVE-2026-71300)

let affectedArtifact = dynamic(["camel-atmosphere-websocket"]);
union isfuzzy=true
(
  // Vulnerable component presence on hosts (SBOM / file inventory)
  DeviceFileEvents
  | where FileName has "camel-atmosphere-websocket" and FileName endswith ".jar"
  | extend VersionParse = extract(@"camel-atmosphere-websocket-([0-9]+\.[0-9]+\.[0-9]+)", 1, FileName)
  | where isnotempty(VersionParse)
  | extend Vulnerable = (VersionParse startswith "4." ) // refine with version compare downstream
  | project TimeGenerated, DeviceName, FileName, FolderPath, VersionParse, Signal="vulnerable-artifact-present"
),
(
  // Inbound WebSocket dispatch header-injection attempts via web proxy / WAF logs
  W3CIISLog
  | where csUriStem has_any ("/camel", "/ws", "/websocket", "/atmosphere")
  | extend Headers = tostring(csHeaders)
  | where Headers has_any ("sendToAll", "connectionKey", "CamelWebsocket", "websocket.connectionKey", "X-Atmosphere", "dispatch")
  | project TimeGenerated, cIP, csUriStem, csUserAgent, Headers, Signal="dispatch-header-injection-attempt"
)
| sort by TimeGenerated desc

(index=web sourcetype="ms:iis:auto" OR sourcetype="access_combined" OR sourcetype="stream:http" (uri_path="*camel*" OR uri_path="*websocket*" OR uri_path="*atmosphere*" OR uri_path="*/ws*"))
| eval hdrs=coalesce(request_headers, http_headers, header)
| search hdrs="*sendToAll*" OR hdrs="*connectionKey*" OR hdrs="*CamelWebsocket*" OR hdrs="*X-Atmosphere*" OR hdrs="*websocket.connectionKey*"
| stats count min(_time) as firstSeen max(_time) as lastSeen values(uri_path) as uris values(hdrs) as headers by src_ip, dest
| eval signal="dispatch-header-injection-attempt"
| where count > 0

any where (
  (event.category == "file" and file.name like "camel-atmosphere-websocket*.jar") or
  (event.category == "network" and (
     url.path like~ "*camel*" or url.path like~ "*websocket*" or url.path like~ "*atmosphere*") and
     (http.request.headers like~ "*sendToAll*" or http.request.headers like~ "*connectionKey*" or http.request.headers like~ "*CamelWebsocket*")
  )
)

SELECT sourceip, destinationip, url, "Request Headers" AS headers, QIDNAME(qid) AS event, starttime
FROM events
WHERE (LOWER(url) LIKE '%camel%' OR LOWER(url) LIKE '%websocket%' OR LOWER(url) LIKE '%atmosphere%')
AND ("Request Headers" ILIKE '%sendToAll%' OR "Request Headers" ILIKE '%connectionKey%' OR "Request Headers" ILIKE '%CamelWebsocket%' OR "Request Headers" ILIKE '%X-Atmosphere%')
ORDER BY starttime DESC LAST 7 DAYS

_sourceCategory=*web* OR _sourceCategory=*proxy*
| where (uri matches "*camel*" or uri matches "*websocket*" or uri matches "*atmosphere*")
| where (request_headers matches "*sendToAll*" or request_headers matches "*connectionKey*" or request_headers matches "*CamelWebsocket*" or request_headers matches "*X-Atmosphere*")
| count by src_ip, uri, request_headers
| sort by _count desc

rule camel_atmosphere_websocket_header_injection_CVE_2026_71300 {
  meta:
    author = "Argus"
    description = "Detects WebSocket dispatch header injection against Apache Camel camel-atmosphere-websocket (CVE-2026-71300)"
    severity = "HIGH"
    cve = "CVE-2026-71300"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    ($e.network.http.request.url = /.*(camel|websocket|atmosphere).*/ nocase)
    ($e.network.http.request_headers = /.*(sendToAll|connectionKey|CamelWebsocket|X-Atmosphere).*/ nocase)
  condition:
    $e
}

#event_simpleName=/^(NetworkConnect|DnsRequest|HttpRequest)$/
| (HttpUrl=/(camel|websocket|atmosphere)/i)
| (HttpHeaders=/(sendToAll|connectionKey|CamelWebsocket|X-Atmosphere)/i)
| groupBy([aid, ComputerName, HttpUrl, HttpHeaders], function=count())
| sort(count, order=desc)