CVE-2026-7191: qnabot-on-aws Admin RCE via Prototype Manipulation

title: CVE-2026-7191: qnabot-on-aws Content Designer RCE via Prototype Manipulation
id: scw-2026-04-27-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-7191 by targeting the qnabot-on-aws Content Designer interface. The vulnerability allows an authenticated administrator to execute arbitrary code via prototype manipulation in the 'eval' functionality. This rule looks for POST requests to the content designer endpoint with 'eval' in the query string and common JavaScript prototype manipulation patterns indicative of an exploit attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-04-27
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7191/
tags:
  - attack.execution
  - attack.t1574.002
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/content/designer'
      cs-method|exact: 'POST'
      cs-uri-query|contains:
          - 'eval'
      # The exact payload will vary, but look for common JS prototype manipulation patterns
      # This is a simplified example and may require tuning based on observed traffic
      # The key is the combination of the path, method, and a suspicious query parameter with JS eval syntax.
  selection_indicators:
      cs-uri-query|contains:
          - 'constructor.constructor("return this")'
          - '__proto__'
          - 'prototype.constructor'
      condition: selection AND selection_indicators
  
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse