# CVE-2026-39987 - Marimo Pre-Auth RCE Indicators of Compromise
# Generated: 2026-04-26
# Severity: CRITICAL (CVSS 9.3)

## Network Signatures

### WebSocket Endpoint
/terminal/ws

### HTTP Request Patterns
GET /terminal/ws HTTP/1.1
Upgrade: websocket
Connection: Upgrade

### WebSocket Message Patterns
{"type":"exec","command":
"type":"output"
"exit_code":

## URL Patterns
http[s]?://[^/]+/terminal/ws
ws[s]?://[^/]+/terminal/ws

## Common Exploit Commands (in WebSocket payloads)
whoami
id
uname -a
cat /etc/passwd
cat /etc/shadow
bash -i
/bin/sh
nc -e /bin/sh
python -c 'import pty
curl http://
wget http://

## Process IOCs

### Suspicious Marimo Child Processes
marimo -> bash
marimo -> sh
marimo -> nc
marimo -> curl
marimo -> wget
marimo -> python (unexpected)

### Process Command Lines
bash -i >& /dev/tcp/
nc -e /bin/sh
python -c 'import socket
rm /tmp/f;mkfifo /tmp/f

## File System IOCs

### Marimo Installation Paths
/usr/local/lib/python*/dist-packages/marimo/
~/.local/lib/python*/site-packages/marimo/
/opt/marimo/

### Vulnerable Version Indicators
marimo 0.20.x
marimo 0.21.x
marimo 0.22.x

## Network IOCs

### Favicon Hash (Shodan)
http.favicon.hash:-1864630356

### Version Endpoint
/api/version

## Splunk Queries

# WebSocket upgrade to /terminal/ws
index=web sourcetype=access_combined uri_path="/terminal/ws" status=101

# Exploit payload detection
index=web sourcetype=access_combined uri_path="/terminal/ws" 
| regex _raw="type.*exec.*command"

# Suspicious Marimo child processes
index=linux sourcetype=linux_secure parent_process="*marimo*" process IN ("bash","sh","nc","curl","wget")

## Elastic / Kibana Queries

# WebSocket connections to terminal endpoint
event.category:network AND url.path:"/terminal/ws" AND http.response.status_code:101

# Marimo process spawning shells
event.category:process AND process.parent.name:*marimo* AND process.name:(bash OR sh OR nc)

## Suricata Rules

alert http any any -> any any (msg:"CVE-2026-39987 Marimo WebSocket Exploit Attempt"; flow:established,to_server; http.uri; content:"/terminal/ws"; http.header; content:"Upgrade|3a 20|websocket"; classtype:web-application-attack; sid:10263987; rev:1;)

alert http any any -> any any (msg:"CVE-2026-39987 Marimo Exec Command Payload"; flow:established,to_server; content:"type"; content:"exec"; content:"command"; distance:0; classtype:web-application-attack; sid:10263988; rev:1;)

## Snort Rules

alert tcp any any -> any any (msg:"CVE-2026-39987 Marimo Terminal WebSocket"; content:"GET"; http_method; content:"/terminal/ws"; http_uri; content:"websocket"; http_header; classtype:attempted-admin; sid:10263987; rev:1;)

## ModSecurity / WAF Rules

# Block unauthenticated WebSocket terminal access
SecRule REQUEST_URI "@contains /terminal/ws" \
    "id:10263987,\
    phase:1,\
    deny,\
    status:403,\
    log,\
    msg:'CVE-2026-39987 - Marimo WebSocket Terminal Blocked'"

## YARA Rule Summary
- CVE_2026_39987_WebSocket_Exploit_Traffic
- CVE_2026_39987_Exploit_Payload
- CVE_2026_39987_Marimo_Vulnerable_Version
- CVE_2026_39987_Response_Shell_Output

## Sigma Rule Summary
- cve-2026-39987-marimo-rce (webserver logs)
- cve-2026-39987-marimo-rce-proc (process creation)

## Remediation

### Immediate
1. Block network access to /terminal/ws endpoint
2. Disconnect affected Marimo instances from network
3. Review logs for IOCs listed above

### Permanent
1. Upgrade to Marimo >= 0.23.0
2. Implement authentication for terminal endpoints
3. Never expose Marimo terminal to public internet
4. Use firewall rules to restrict access to trusted IPs only

## References
- CVE-2026-39987: https://nvd.nist.gov/vuln/detail/CVE-2026-39987
- CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Public PoC: https://github.com/fevar54/marimo_CVE-2026-39987_RCE_PoC
- Endor Labs Advisory: https://www.endorlabs.com/learn/root-in-one-request-marimos-critical-pre-auth-rce-cve-2026-39987
