Plex Media Server Encoded URI Scheme Neutralization Vulnerability (CVE-2026-96654)

let plexPorts = dynamic([32400]);
let encodedSchemePatterns = dynamic(["javascript%3a","java%0ascript","%6a%61%76%61%73%63%72%69%70%74","data%3atext%2fhtml","javascript","javascript","%26%23x6a","vbscript%3a"]);
W3CIISLog
| where csUriStem has_cs "/web" or csUriStem has_cs "/library" or csUriStem has_cs "/:/"
| extend decodedQuery = tolower(url_decode(csUriQuery))
| extend rawLower = tolower(strcat(csUriStem, "?", csUriQuery))
| where rawLower has_any (encodedSchemePatterns) or decodedQuery has "javascript:" or decodedQuery has "data:text/html" or decodedQuery has "vbscript:"
| where sPort in (plexPorts) or csUriStem has_cs "/:/"
| project TimeGenerated, cIP, sIP, sPort, csMethod, csUriStem, csUriQuery, decodedQuery, scStatus, csUserAgent
| sort by TimeGenerated desc

index=web (dest_port=32400 OR uri_path="/web*" OR uri_path="/library*" OR uri_path="/:/*")
| eval decoded=urldecode(lower(uri_query))
| where match(lower(uri_query),"javascript%3a|%6a%61%76%61%73%63%72%69%70%74|data%3atext%2fhtml|vbscript%3a|&#x?6a;?|j") OR match(decoded,"javascript:|data:text/html|vbscript:")
| table _time src_ip dest_ip dest_port http_method uri_path uri_query decoded status http_user_agent
| sort - _time

sequence by source.ip with maxspan=5m
  [network where destination.port == 32400 and network.direction == "ingress"]
  [any where (url.query : "*javascript%3a*" or url.query : "*%6a%61%76%61%73%63%72%69%70%74*" or url.query : "*data%3atext%2fhtml*" or url.query : "*vbscript%3a*" or url.original : "*javascript*" or url.original : "*javascript*")]

SELECT QIDNAME(qid) AS event, sourceip, destinationip, destinationport, "URL", "UserAgent", starttime FROM events WHERE destinationport = 32400 AND (LOWER("URL") ILIKE '%javascript%3a%' OR LOWER("URL") ILIKE '%%6a%61%76%61%73%63%72%69%70%74%' OR LOWER("URL") ILIKE '%data%3atext%2fhtml%' OR LOWER("URL") ILIKE '%vbscript%3a%' OR "URL" ILIKE '%javascript%' OR "URL" ILIKE '%javascript%') ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*web* (dest_port=32400 OR "/web" OR "/library" OR "/:/")
| tolowercase(uri_query) as q
| where q matches "*javascript%3a*" or q matches "*%6a%61%76%61%73%63%72%69%70%74*" or q matches "*data%3atext%2fhtml*" or q matches "*vbscript%3a*" or uri_query matches "*javascript*" or uri_query matches "*javascript*"
| fields _messagetime, src_ip, dest_ip, dest_port, http_method, uri_path, uri_query, status_code, user_agent
| sort by _messagetime desc

rule plex_cve_2026_96654_encoded_uri_scheme {
  meta:
    author = "argus"
    description = "Detects encoded URI scheme payloads against Plex Media Server (CVE-2026-96654, CWE-84)"
    severity = "HIGH"
    reference = "CVE-2026-96654"
  events:
    $e.network.http.method = /GET|POST/
    ($e.target.port = 32400 or $e.target.url = /\/(web|library|:\/)/ nocase)
    (
      re.regex($e.target.url, `javascript%3a`) nocase or
      re.regex($e.target.url, `%6a%61%76%61%73%63%72%69%70%74`) nocase or
      re.regex($e.target.url, `data%3atext%2fhtml`) nocase or
      re.regex($e.target.url, `vbscript%3a`) nocase or
      re.regex($e.target.url, `&#x?6a;?avascript`) nocase or
      re.regex($e.target.url, `javascript`) nocase
    )
  condition:
    $e
}

#event_simpleName=/^(DnsRequest|NetworkConnectIP4|HttpRequest)$/
| (RemotePort=32400 OR HttpPath=/\/(web|library|:\/)/i OR HttpUrl=/.+/)
| HttpUrl=/(javascript%3a|%6a%61%76%61%73%63%72%69%70%74|data%3atext%2fhtml|vbscript%3a|&#x?6a;?avascript|javascript)/i
| table([@timestamp, aid, ComputerName, LocalAddressIP4, RemoteAddressIP4, RemotePort, HttpMethod, HttpUrl])
| sort(@timestamp, order=desc)