Arista VeloCloud Orchestrator Improper Input Validation (CVE-2026-93952)

let vcoHosts = dynamic(["velocloud", "vco", "orchestrator"]);
let suspiciousPaths = dynamic(["/portal/", "/login/", "/api/", "/admin/", "/edge/"]);
CommonSecurityLog
| where DeviceVendor has_any ("Arista", "VeloCloud") or DestinationHostName has_any (vcoHosts)
| where RequestURL has_any (suspiciousPaths)
| where RequestMethod in ("POST", "PUT")
| where RequestURL matches regex @"(?i)(\.\.\/|%2e%2e|;|\||`|\$\(|<script|union\s+select|exec\s*\()" 
    or RequestContext matches regex @"(?i)(\.\.\/|%2e%2e|;|\||`|\$\()"
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, RequestMethod, RequestURL, RequestContext, DeviceVendor
| summarize Count=count(), Paths=make_set(RequestURL, 20) by SourceIP, DestinationIP, DestinationHostName, bin(TimeGenerated, 10m)
| where Count >= 1

index=proxy OR index=network (dest_host="*velocloud*" OR dest_host="*vco*" OR dest_host="*orchestrator*" OR vendor="Arista" OR vendor="VeloCloud")
| where (like(url,"%/portal/%") OR like(url,"%/api/%") OR like(url,"%/admin/%") OR like(url,"%/edge/%") OR like(url,"%/login/%"))
| where (method="POST" OR method="PUT")
| regex _raw="(?i)(\.\./|%2e%2e|;|\||`|\$\(|<script|union\s+select|exec\s*\()"
| stats count as hits values(url) as urls by src_ip dest_ip dest_host method
| where hits >= 1

sequence by destination.ip with maxspan=10m
  [network where (url.path like "/api/*" or url.path like "/portal/*" or url.path like "/admin/*") and http.request.method in ("POST","PUT") and (url.query : "*../*" or url.query : "*%2e%2e*" or http.request.body.content : "*$(*" or http.request.body.content : "*;*")]
  [process where event.type == "start" and process.parent.name in ("java","nginx","node","python","httpd") and process.name in ("sh","bash","curl","wget","nc")]

SELECT sourceip, destinationip, "URL", "HTTP Method", QIDNAME(qid) AS event_name FROM events WHERE ("URL" ILIKE '%/api/%' OR "URL" ILIKE '%/portal/%' OR "URL" ILIKE '%/admin/%') AND "HTTP Method" IN ('POST','PUT') AND ("URL" IMATCHES '.*(\.\./|%2e%2e|;|\||`|\$\().*' OR payload IMATCHES '.*(\.\./|%2e%2e|\$\(|<script).*') AND (destinationip IN (SELECT destinationip FROM reference_data WHERE name='velocloud_orchestrators') OR "Vendor" ILIKE '%Arista%') LAST 1 HOURS

_sourceCategory=*proxy* OR _sourceCategory=*network* ("velocloud" OR "vco" OR "orchestrator" OR "Arista")
| parse regex "(?<method>GET|POST|PUT|DELETE)\s+(?<url>\S+)" nodrop
| where method in ("POST","PUT")
| where url matches /(?i).*(\/api\/|\/portal\/|\/admin\/|\/edge\/).*/
| where _raw matches /(?i).*(\.\.\/|%2e%2e|;|\||`|\$\(|<script|union\s+select).*/
| count by src_ip, dest_host, url
| where _count >= 1

rule velocloud_orchestrator_cve_2026_93952 {
  meta:
    author = "Argus"
    description = "Detects CVE-2026-93952 improper input validation exploitation against Arista VeloCloud Orchestrator"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = /POST|PUT/
    $e.target.url = /(\/api\/|\/portal\/|\/admin\/|\/edge\/)/
    $e.target.url = /(\.\.\/|%2e%2e|;|\||`|\$\(|<script|union\s+select)/ nocase
    ($e.target.hostname = /velocloud|vco|orchestrator/ nocase or $e.principal.application = /Arista/ nocase)
    $ip = $e.target.ip
  match:
    $ip over 10m
  condition:
    $e
}

#event_simpleName=/^(ProcessRollup2|NetworkConnectIP4)$/
| ImageFileName=/(java|nginx|node|httpd|python)/i
| CommandLine=/(sh|bash|curl|wget|nc|ncat)\s/i
| CommandLine=/(\.\.\/|\$\(|;|\||`|%2e%2e)/i
| groupBy([aid, ParentBaseFileName], function=([count(as=spawns), collect([CommandLine, ImageFileName])]))
| spawns >= 1