CVE-2026-33467 — Improper Verification of Cryptographic Signature (CWE-347)

title: CVE-2026-33467 - Tampered Elastic Package Registry Package Download
id: scw-2026-04-28-ai-1
status: experimental
level: high
description: |
  This rule detects potential exploitation of CVE-2026-33467 by identifying requests to the Elastic Package Registry API that are likely attempting to download a package. The vulnerability allows an attacker to substitute a tampered package if they can intercept network traffic or influence the self-hosted registry. This detection focuses on the download endpoint and looks for common query parameters associated with package retrieval, indicating an attempt to fetch a package that might be tampered with.
author: SCW Feed Engine (AI-generated)
date: 2026-04-28
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-33467/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/registry/v1/packages/'
      sc-status:
          - 200
      cs-method:
          - 'GET'
  selection_tampered_package:
      cs-uri-query|contains:
          - 'version=' # Heuristic: look for version parameter, though exact exploit might vary
      condition: selection AND selection_tampered_package
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse