From 8346fc4559703c0cf2e9b23f6e0e9424abf1b66c Mon Sep 17 00:00:00 2001 From: crowdsec-automation <63358111+crowdsec-automation@users.noreply.github.com> Date: Sat, 14 Nov 2026 10:03:48 +0100 Subject: [PATCH 1/5] Add vpatch-CVE-2026-96654 rule --- .../crowdsecurity/vpatch-CVE-2026-96654.yaml | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 appsec-rules/crowdsecurity/vpatch-CVE-2026-96654.yaml diff --git a/appsec-rules/crowdsecurity/vpatch-CVE-2026-96654.yaml b/appsec-rules/crowdsecurity/vpatch-CVE-2026-96654.yaml new file mode 100644 index 00000000000..310f512bbd7 --- /dev/null +++ b/appsec-rules/crowdsecurity/vpatch-CVE-2026-96654.yaml @@ -0,0 +1,45 @@ +## autogenerated on 2026-11-14 09:03:45 +name: crowdsecurity/vpatch-CVE-2026-96654 +description: 'Detects Plex Media Server SSRF via the vulnerable searchOne protocol parameter.' +rules: + - and: + - zones: + - URI + transform: + - urldecode + - lowercase + match: + type: contains + value: '/player/timeline/subscribe' + - zones: + - ARGS + variables: + - protocol + transform: + - urldecode + - lowercase + match: + type: contains + value: 'searchone' + - zones: + - ARGS + variables: + - protocol + transform: + - urldecode + - lowercase + match: + type: contains + value: '127.0.0.1' + +labels: + type: exploit + service: http + confidence: 3 + spoofable: 0 + behavior: 'http:exploit' + label: 'Plex Media Server - SSRF' + classification: + - cve.CVE-2026-96654 + - attack.T1190 + - cwe.CWE-84 From 8c4bcee44fa6028fd8b8e879daaf058448bb23a6 Mon Sep 17 00:00:00 2001 From: crowdsec-automation <63358111+crowdsec-automation@users.noreply.github.com> Date: Sat, 14 Nov 2026 10:03:51 +0100 Subject: [PATCH 2/5] Add vpatch-CVE-2026-96654 documentation --- appsec-rules/crowdsecurity/vpatch-CVE-2026-96654.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 appsec-rules/crowdsecurity/vpatch-CVE-2026-96654.md diff --git a/appsec-rules/crowdsecurity/vpatch-CVE-2026-96654.md b/appsec-rules/crowdsecurity/vpatch-CVE-2026-96654.md new file mode 100644 index 00000000000..f4f44a7355f --- /dev/null +++ b/appsec-rules/crowdsecurity/vpatch-CVE-2026-96654.md @@ -0,0 +1,9 @@ +This rule provides virtual patching for **CVE-2026-96654**, a Parameter Injection vulnerability in **Media Server** (Plex), published on 2026-09-23, with a CVSS score of **6.9 (Medium)**. + +**Detection:** Detects Plex Media Server SSRF via the vulnerable searchOne protocol parameter. + +Virtual patching mitigates exploitation attempts, but it does not fix the underlying vulnerability: upgrading Media Server to a patched version is always recommended. + +### References +- [CVE-2026-96654 on NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-96654) +- [Exploit reference](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-96654.yaml) From d16e7303cfd1d96d33a5e2d5f2cdae3db1885af7 Mon Sep 17 00:00:00 2001 From: crowdsec-automation <63358111+crowdsec-automation@users.noreply.github.com> Date: Sat, 14 Nov 2026 10:03:53 +0100 Subject: [PATCH 3/5] Add vpatch-CVE-2026-96654 test config --- .appsec-tests/vpatch-CVE-2026-96654/config.yaml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .appsec-tests/vpatch-CVE-2026-96654/config.yaml diff --git a/.appsec-tests/vpatch-CVE-2026-96654/config.yaml b/.appsec-tests/vpatch-CVE-2026-96654/config.yaml new file mode 100644 index 00000000000..14e4f58e764 --- /dev/null +++ b/.appsec-tests/vpatch-CVE-2026-96654/config.yaml @@ -0,0 +1,5 @@ +## autogenerated on 2026-11-14 09:03:45 +appsec-rules: + - ./appsec-rules/crowdsecurity/base-config.yaml + - ./appsec-rules/crowdsecurity/vpatch-CVE-2026-96654.yaml +nuclei_template: CVE-2026-96654.yaml From 333634df71a10ab686ceafbbefdd56c24094b707 Mon Sep 17 00:00:00 2001 From: crowdsec-automation <63358111+crowdsec-automation@users.noreply.github.com> Date: Sat, 14 Nov 2026 10:03:56 +0100 Subject: [PATCH 4/5] Add CVE-2026-96654.yaml test --- .../vpatch-CVE-2026-96654/CVE-2026-96654.yaml | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .appsec-tests/vpatch-CVE-2026-96654/CVE-2026-96654.yaml diff --git a/.appsec-tests/vpatch-CVE-2026-96654/CVE-2026-96654.yaml b/.appsec-tests/vpatch-CVE-2026-96654/CVE-2026-96654.yaml new file mode 100644 index 00000000000..7959cf6ef39 --- /dev/null +++ b/.appsec-tests/vpatch-CVE-2026-96654/CVE-2026-96654.yaml @@ -0,0 +1,28 @@ +## autogenerated on 2026-11-14 09:03:45 +id: CVE-2026-96654 +info: + name: CVE-2026-96654 + author: crowdsec + severity: info + description: CVE-2026-96654 testing + tags: appsec-testing +http: + - raw: + - | + GET /player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http%3A%2F%2F127.0.0.1%3A32400%2Fsystem%2Fagents%2Fz%2FsearchOne%3FmediaType%3D1%26lang%3Den%26identifier%3Dcom.plexapp.agents.thetvdb%252Ffunction%252FGetResultFromNetwork%253Furl%253Dhttp%253A%252F%252Fexample.com%2523&port=1337&commandID=1&X-Plex-Target-Client-Identifier=test-client HTTP/1.1 + Host: {{Hostname}} + X-Plex-Token: test-token + X-Plex-Client-Identifier: test-client + X-Plex-Platform: test + X-Plex-Platform-Version: 1 + X-Plex-Product: test + X-Plex-Version: 1 + X-Plex-Device: test + X-Plex-Device-Name: test + X-Plex-Model: test + + cookie-reuse: true + matchers: + - type: status + status: + - 403 From 0c01c845125438a2ea514002f1ed0739ebbd6277 Mon Sep 17 00:00:00 2001 From: crowdsec-automation <63358111+crowdsec-automation@users.noreply.github.com> Date: Sat, 14 Nov 2026 10:03:58 +0100 Subject: [PATCH 5/5] Add vpatch-CVE-2026-96654 rule to vpatch collection --- collections/crowdsecurity/appsec-virtual-patching.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/collections/crowdsecurity/appsec-virtual-patching.yaml b/collections/crowdsecurity/appsec-virtual-patching.yaml index 64873bfc20b..9321d352b2d 100644 --- a/collections/crowdsecurity/appsec-virtual-patching.yaml +++ b/collections/crowdsecurity/appsec-virtual-patching.yaml @@ -69,6 +69,7 @@ appsec-rules: - crowdsecurity/vpatch-CVE-2023-47218 - crowdsecurity/vpatch-git-config - crowdsecurity/vpatch-CVE-2024-32113 +- crowdsecurity/vpatch-CVE-2026-96654 - crowdsecurity/vpatch-CVE-2024-3272 - crowdsecurity/vpatch-CVE-2024-28255 - crowdsecurity/vpatch-CVE-2024-29824