CVE-2026-43644 — Cross-Site Scripting (XSS)

title: CVE-2026-43644 - Reflected XSS via /echo endpoint
id: scw-2026-05-14-ai-1
status: experimental
level: medium
description: |
  Detects attempts to exploit CVE-2026-43644 by sending requests to the /echo endpoint. This vulnerability allows reflected XSS because the application reflects request body content without proper content type handling, leading to script execution in the context of the podinfo origin. This rule specifically targets the vulnerable endpoint and method.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-43644/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      uri|contains:
          - '/echo'
      cs-method:
          - 'POST'
      sc-status:
          - 200
      # The exact payload will vary, but look for common XSS patterns reflected in the body
      # This is a simplified example; a real-world rule might need more sophisticated payload analysis
      # For this specific CVE, the vulnerability is in how the request body is handled and reflected.
      # The absence of Content-Type and X-Content-Type-Options headers is key.
      # Detecting the *reflection* of a script is the goal here, which is hard without body inspection.
      # However, targeting the vulnerable endpoint with POST requests is a strong indicator.
      # A more advanced rule could potentially look for specific HTML/JS patterns in response bodies if available.
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse