Metabase SQL Injection Exploitation (CVE-2026-72898)

let sqlInjectionPatterns = dynamic(["union select","' or '1'='1","' or 1=1","waitfor delay","pg_sleep","sleep(","information_schema","' and '1'='1","; drop ","convert(int","cast(","benchmark(","--","/*","xp_cmdshell","load_file("]);
let metabasePaths = dynamic(["/api/dataset","/api/card","/api/database","/api/setup","/api/session","/api/embed","/api/public"]);
CommonSecurityLog
| where DeviceVendor in~ ("Zscaler","Palo Alto Networks","F5","Fortinet") or isnotempty(RequestURL)
| where RequestURL has_any (metabasePaths) or DestinationServicePort in (3000, 443)
| extend decodedUri = url_decode(RequestURL)
| where decodedUri has_any (sqlInjectionPatterns)
| project TimeGenerated, SourceIP, DestinationIP, DestinationServicePort, RequestURL, decodedUri, DeviceAction, RequestMethod, SourceUserName
| summarize AttemptCount = count(), SamplePayloads = make_set(decodedUri, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP
| where AttemptCount >= 1
| order by AttemptCount desc

index=proxy OR index=web sourcetype IN ("pan:traffic","cisco:asa","nginx:plus:access","apache:access")
(uri_path="/api/dataset*" OR uri_path="/api/card*" OR uri_path="/api/database*" OR uri_path="/api/public*" OR uri_path="/api/embed*")
| eval decoded=urldecode(uri_query)
| where match(decoded, "(?i)(union\s+select|'\s*or\s*'?1'?\s*=\s*'?1|pg_sleep\(|waitfor\s+delay|information_schema|benchmark\(|xp_cmdshell|load_file\(|;\s*drop\s)")
| stats count AS attempts values(decoded) AS payloads min(_time) AS first_seen max(_time) AS last_seen by src_ip dest_ip uri_path http_method
| where attempts >= 1
| sort - attempts

network where destination.port in (3000, 443) and
  (url.path : ("/api/dataset*", "/api/card*", "/api/database*", "/api/public*", "/api/embed*")) and
  (url.query : ("*union*select*", "*or*1=1*", "*pg_sleep*", "*waitfor*delay*", "*information_schema*", "*benchmark(*", "*xp_cmdshell*", "*load_file(*"))

SELECT sourceip, destinationip, destinationport, "URL", "Request Method", COUNT(*) AS attempts, MIN(starttime) AS first_seen, MAX(starttime) AS last_seen FROM events WHERE ("URL" ILIKE '%/api/dataset%' OR "URL" ILIKE '%/api/card%' OR "URL" ILIKE '%/api/database%' OR "URL" ILIKE '%/api/public%' OR "URL" ILIKE '%/api/embed%') AND ("URL" ILIKE '%union%select%' OR "URL" ILIKE '%or%1=1%' OR "URL" ILIKE '%pg_sleep%' OR "URL" ILIKE '%waitfor%delay%' OR "URL" ILIKE '%information_schema%' OR "URL" ILIKE '%benchmark(%' OR "URL" ILIKE '%xp_cmdshell%' OR "URL" ILIKE '%load_file(%') GROUP BY sourceip, destinationip, destinationport, "URL", "Request Method" LAST 24 HOURS

_sourceCategory=*proxy* OR _sourceCategory=*web*
| where url matches "*/api/dataset*" or url matches "*/api/card*" or url matches "*/api/database*" or url matches "*/api/public*" or url matches "*/api/embed*"
| where toLowerCase(url) matches "*union*select*" or toLowerCase(url) matches "*or*1=1*" or toLowerCase(url) matches "*pg_sleep*" or toLowerCase(url) matches "*waitfor*delay*" or toLowerCase(url) matches "*information_schema*" or toLowerCase(url) matches "*benchmark(*" or toLowerCase(url) matches "*xp_cmdshell*"
| count as attempts, min(_messagetime) as first_seen, max(_messagetime) as last_seen by src_ip, dest_ip, url
| where attempts >= 1
| sort by attempts desc

rule metabase_sqli_cve_2026_72898 {
  meta:
    author = "Argus Detection Platform"
    description = "Detects SQL injection exploitation against Metabase (CVE-2026-72898)"
    severity = "CRITICAL"
    cve = "CVE-2026-72898"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /\/api\/(dataset|card|database|public|embed)/ nocase
    $e.target.url = /(union\s+select|'\s*or\s*'?1'?=\s*'?1|pg_sleep\(|waitfor\s+delay|information_schema|benchmark\(|xp_cmdshell|load_file\()/ nocase
    $src = $e.principal.ip
  match:
    $src over 10m
  condition:
    $e
}

#event_simpleName=/HttpRequest|NetworkConnect/
| DomainName=* OR HttpPath=*
| HttpPath=/\/api\/(dataset|card|database|public|embed)/i
| HttpQuery=/(union\s+select|'\s*or\s*'?1'?=\s*'?1|pg_sleep\(|waitfor\s+delay|information_schema|benchmark\(|xp_cmdshell|load_file\()/i
| groupBy([aid, RemoteAddressIP4, HttpPath], function=([count(as=attempts), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)]))
| attempts >= 1