@panguard-ai/panguard-guard 0.2.0 → 0.2.2

package/bundled-rules/sigma-rules/auto-generated/.meta.json

@@ -0,0 +1,626 @@
+{
+  "lastSyncAt": "2026-03-07T16:13:26.263Z",
+  "reports": [
+    {
+      "id": "2701701",
+      "title": "Injection in path parameter of Ingress-nginx",
+      "severity": "high",
+      "cweId": "CWE-94",
+      "cweName": "Code Injection",
+      "cveIds": [
+        "CVE-2021-25748"
+      ],
+      "summary": "A vulnerability was discovered in the Ingress-nginx controller where an attacker could inject arbitrary content into the path parameter of an Ingress. This allowed the attacker to upload a malicious nginx configuration file to the ingress controller's file system and then include that file in a subsequent Ingress. The attacker could then execute arbitrary code on the ingress controller.",
+      "disclosedAt": "2026-03-07T05:10:30.190Z",
+      "programHandle": "kubernetes",
+      "programName": "Kubernetes",
+      "reporterUsername": "fisjkars",
+      "url": "https://hackerone.com/reports/2701701",
+      "fetchedAt": "2026-03-07T16:12:10.089Z"
+    },
+    {
+      "id": "1734639",
+      "title": "IDOR to make someone attend or leave an event",
+      "severity": "medium",
+      "cweId": "CWE-639",
+      "cweName": "Insecure Direct Object Reference (IDOR)",
+      "cveIds": [],
+      "summary": "An Insecure Direct Object Reference (IDOR) vulnerability was discovered in LinkedIn's event attendance functionality. The vulnerability allowed an attacker to manipulate event attendance by modifying the fsd_profile parameter in POST requests to the voyagerScheduledcontentDashViewerStates API endpoint. This issue has been fixed.",
+      "disclosedAt": "2026-03-06T02:55:04.893Z",
+      "programHandle": "linkedin",
+      "programName": "LinkedIn",
+      "reporterUsername": "safehacker_2715",
+      "url": "https://hackerone.com/reports/1734639",
+      "fetchedAt": "2026-03-07T16:12:13.556Z"
+    },
+    {
+      "id": "2339192",
+      "title": "Blocking a company page admin prevents him from delete paid media admin or edit his roles",
+      "severity": "medium",
+      "cweId": null,
+      "cweName": "Improper Access Control - Generic",
+      "cveIds": [],
+      "summary": "A company page admin was prevented from managing (deleting or editing roles of) a paid media admin when the paid media admin blocked the company page admin. This created an access control vulnerability where administrative privileges were circumvented through the platform's social blocking feature.",
+      "disclosedAt": "2026-03-05T23:37:30.480Z",
+      "programHandle": "linkedin",
+      "programName": "LinkedIn",
+      "reporterUsername": "riadalrashed",
+      "url": "https://hackerone.com/reports/2339192",
+      "fetchedAt": "2026-03-07T16:12:14.529Z"
+    },
+    {
+      "id": "3581815",
+      "title": "Open Redirect on lovable.dev via redirect parameter leads to phishing attacks",
+      "severity": "medium",
+      "cweId": null,
+      "cweName": null,
+      "cveIds": [],
+      "summary": "An open redirect vulnerability was discovered on the website lovable.dev. After logging in, a request was sent to a URL with a 'redirect' parameter. By supplying a backslash-prefixed value for the 'redirect' parameter, the user could be redirected to an external domain. This vulnerability could have been exploited to craft malicious URLs on the lovable.dev domain that redirect users to arbitrary external sites.",
+      "disclosedAt": "2026-03-05T22:38:35.514Z",
+      "programHandle": "lovable-vdp",
+      "programName": "Lovable VDP",
+      "reporterUsername": "jdc94",
+      "url": "https://hackerone.com/reports/3581815",
+      "fetchedAt": "2026-03-07T16:12:14.529Z"
+    },
+    {
+      "id": "3524779",
+      "title": "DoS via Unbounded Memory Allocation in sendWebStream on Fastify v5.7.0+ leads to OOM crash when backpressure is ignored",
+      "severity": "medium",
+      "cweId": null,
+      "cweName": null,
+      "cveIds": [
+        "CVE-2026-25224"
+      ],
+      "summary": "A vulnerability was discovered in Fastify versions 5.7.0 and later. The issue was in the \"sendWebStream\" function, which failed to handle TCP backpressure correctly. When a ReadableStream was sent as a response, Fastify continuously pulled data from the stream producer and wrote it to the response object, ignoring the return value of the write operation. This allowed a fast producer to fill the server's memory indefinitely, leading to an Out-Of-Memory (OOM) crash if a client stopped reading the response.",
+      "disclosedAt": "2026-03-05T15:49:48.849Z",
+      "programHandle": "fastify",
+      "programName": "Fastify",
+      "reporterUsername": "onlybugs05",
+      "url": "https://hackerone.com/reports/3524779",
+      "fetchedAt": "2026-03-07T16:12:16.546Z"
+    },
+    {
+      "id": "3506183",
+      "title": "Missing Access Control in MigrationFile allows attacker to upload files to any Migration",
+      "severity": "high",
+      "cweId": "CWE-639",
+      "cweName": "Insecure Direct Object Reference (IDOR)",
+      "cveIds": [
+        "CVE-2026-1355"
+      ],
+      "summary": "A Missing Authorization vulnerability was identified in GitHub Enterprise Server that allowed unauthorized content to be uploaded to a user's repository migration export due to a missing authorization check in the repository migration upload endpoint. The vulnerability could be exploited by supplying the migration identifier to overwrite or replace a victim's migration archive.",
+      "disclosedAt": "2026-03-05T02:23:08.428Z",
+      "programHandle": "github",
+      "programName": "GitHub",
+      "reporterUsername": "ahacker1",
+      "url": "https://hackerone.com/reports/3506183",
+      "fetchedAt": "2026-03-07T16:12:18.631Z"
+    },
+    {
+      "id": "3584149",
+      "title": "SSTI leads to Command injection",
+      "severity": "none",
+      "cweId": null,
+      "cweName": "Command Injection - Generic",
+      "cveIds": [],
+      "summary": null,
+      "disclosedAt": "2026-03-04T13:26:30.026Z",
+      "programHandle": "curl",
+      "programName": "curl",
+      "reporterUsername": "errorbehavior200",
+      "url": "https://hackerone.com/reports/3584149",
+      "fetchedAt": "2026-03-07T16:12:21.548Z"
+    },
+    {
+      "id": "3580247",
+      "title": "Use after free in hyperfifo example",
+      "severity": "none",
+      "cweId": null,
+      "cweName": "Use After Free",
+      "cveIds": [],
+      "summary": null,
+      "disclosedAt": "2026-03-03T06:54:27.696Z",
+      "programHandle": "curl",
+      "programName": "curl",
+      "reporterUsername": "deepbluev7",
+      "url": "https://hackerone.com/reports/3580247",
+      "fetchedAt": "2026-03-07T16:12:29.621Z"
+    },
+    {
+      "id": "3356149",
+      "title": "2FA requirement bypass when inviting team members",
+      "severity": "medium",
+      "cweId": null,
+      "cweName": "Improper Access Control - Generic",
+      "cveIds": [],
+      "summary": "The application's requirement for users to enable 2FA before sending team invitations was bypassed by modifying client-side responses. This allowed invitations to be sent without enabling 2FA, defeating the security requirement.",
+      "disclosedAt": "2026-02-28T20:55:04.149Z",
+      "programHandle": "omise",
+      "programName": "Omise",
+      "reporterUsername": "0x7ashish",
+      "url": "https://hackerone.com/reports/3356149",
+      "fetchedAt": "2026-03-07T16:12:35.565Z"
+    },
+    {
+      "id": "3514122",
+      "title": "Password Reuse Vulnerability on AWS Sign-in Page via Password Reset Flow leads to Security Policy Violation",
+      "severity": "none",
+      "cweId": null,
+      "cweName": "Weak Password Requirements",
+      "cveIds": [],
+      "summary": null,
+      "disclosedAt": "2026-02-26T22:20:32.448Z",
+      "programHandle": "aws_vdp",
+      "programName": "AWS VDP",
+      "reporterUsername": "h0ne_analyst_94cm4n1",
+      "url": "https://hackerone.com/reports/3514122",
+      "fetchedAt": "2026-03-07T16:12:39.525Z"
+    },
+    {
+      "id": "3575245",
+      "title": "Integer Overflow in curl_multi_get_handles() Leading to Heap Buffer Overflow",
+      "severity": "medium",
+      "cweId": null,
+      "cweName": "Classic Buffer Overflow",
+      "cveIds": [],
+      "summary": null,
+      "disclosedAt": "2026-02-26T18:58:16.429Z",
+      "programHandle": "curl",
+      "programName": "curl",
+      "reporterUsername": "knickers",
+      "url": "https://hackerone.com/reports/3575245",
+      "fetchedAt": "2026-03-07T16:12:40.623Z"
+    },
+    {
+      "id": "3575250",
+      "title": "RTSP RTP Interleaved Parser Assertion Failure (Zero-Length RTP Payload)",
+      "severity": "none",
+      "cweId": null,
+      "cweName": "Improper Check or Handling of Exceptional Conditions",
+      "cveIds": [],
+      "summary": null,
+      "disclosedAt": "2026-02-26T18:58:06.239Z",
+      "programHandle": "curl",
+      "programName": "curl",
+      "reporterUsername": "davkor",
+      "url": "https://hackerone.com/reports/3575250",
+      "fetchedAt": "2026-03-07T16:12:40.623Z"
+    },
+    {
+      "id": "3424998",
+      "title": "AI Playground XSS to steal user-chat messages and access to connected MCP Server",
+      "severity": "low",
+      "cweId": null,
+      "cweName": "Cross-site Scripting (XSS) - Reflected",
+      "cveIds": [],
+      "summary": "A reflected XSS vulnerability was discovered in the AI Playground OAuth handler due to unescaped interpolation of the error_description parameter into a script tag. The issue has been patched, and users of the open-source Agents SDK should upgrade to v0.3.10.",
+      "disclosedAt": "2026-02-26T18:56:53.331Z",
+      "programHandle": "cloudflare",
+      "programName": "Cloudflare Public Bug Bounty",
+      "reporterUsername": "matured_kazama",
+      "url": "https://hackerone.com/reports/3424998",
+      "fetchedAt": "2026-03-07T16:12:40.623Z"
+    },
+    {
+      "id": "3574928",
+      "title": "Able to bypass HSTS using trailing dot",
+      "severity": "medium",
+      "cweId": null,
+      "cweName": "Missing Required Cryptographic Step",
+      "cveIds": [],
+      "summary": null,
+      "disclosedAt": "2026-02-26T17:46:48.665Z",
+      "programHandle": "curl",
+      "programName": "curl",
+      "reporterUsername": "shan_nandi",
+      "url": "https://hackerone.com/reports/3574928",
+      "fetchedAt": "2026-03-07T16:12:40.623Z"
+    },
+    {
+      "id": "3575475",
+      "title": "Curl Telnet Handler Buffer Overflow",
+      "severity": "none",
+      "cweId": null,
+      "cweName": "Buffer Underflow",
+      "cveIds": [],
+      "summary": null,
+      "disclosedAt": "2026-02-26T15:56:31.985Z",
+      "programHandle": "curl",
+      "programName": "curl",
+      "reporterUsername": "pelioro",
+      "url": "https://hackerone.com/reports/3575475",
+      "fetchedAt": "2026-03-07T16:12:40.623Z"
+    },
+    {
+      "id": "3556892",
+      "title": "HTML Injection in DAST Trial Request Form Confirmation Email – PortSwigger",
+      "severity": "low",
+      "cweId": null,
+      "cweName": null,
+      "cveIds": [],
+      "summary": "A vulnerability was discovered in the DAST trial request form on the website, where user input in the \"First Name\" field was not properly sanitized before being included in confirmation emails. This allowed the injection of arbitrary HTML content, which would be rendered in the recipient's email client.",
+      "disclosedAt": "2026-02-26T09:19:59.404Z",
+      "programHandle": "portswigger",
+      "programName": "PortSwigger Web Security",
+      "reporterUsername": "zorixu",
+      "url": "https://hackerone.com/reports/3556892",
+      "fetchedAt": "2026-03-07T16:12:42.577Z"
+    },
+    {
+      "id": "3360293",
+      "title": "Publicly accessible `█████████` endpoint exposing internal user identifiers and email addresses",
+      "severity": "medium",
+      "cweId": "CWE-200",
+      "cweName": "Information Disclosure",
+      "cveIds": [],
+      "summary": "A publicly accessible JSON API endpoint was found to expose sensitive user information, including internal identifiers and email addresses. The vulnerability was classified as an information disclosure issue with a medium severity rating. The problem was remediated by implementing proper authentication controls and data minimization practices.",
+      "disclosedAt": "2026-02-24T20:50:46.898Z",
+      "programHandle": "mars",
+      "programName": "Mars",
+      "reporterUsername": "xgoon",
+      "url": "https://hackerone.com/reports/3360293",
+      "fetchedAt": "2026-03-07T16:12:49.889Z"
+    },
+    {
+      "id": "2200329",
+      "title": "CVE-█████-35813 in █████",
+      "severity": "critical",
+      "cweId": null,
+      "cweName": "Relative Path Traversal",
+      "cveIds": [
+        "CVE-2023-35813"
+      ],
+      "summary": "A critical remote code execution vulnerability (CVE-█████-35813) affecting multiple Sitecore products through version 10.3 was discovered. The vulnerability was exploited through the sitecore_xaml.ashx endpoint using ASP.NET TemplateParser injection, allowing attackers to execute arbitrary code. The organization successfully applied the Sitecore security patch, and subsequent retesting confirmed the vulnerability was fully remediated.",
+      "disclosedAt": "2026-02-24T20:44:40.069Z",
+      "programHandle": "mars",
+      "programName": "Mars",
+      "reporterUsername": "0xr2r",
+      "url": "https://hackerone.com/reports/2200329",
+      "fetchedAt": "2026-03-07T16:12:49.889Z"
+    },
+    {
+      "id": "3376598",
+      "title": "Sensitive information exposed at [███] via /export_panelists_to_xlsx endpoint",
+      "severity": "medium",
+      "cweId": null,
+      "cweName": "Cleartext Storage of Sensitive Information",
+      "cveIds": [],
+      "summary": "A vulnerability was identified that allowed unauthorized access to personally identifiable information through an unprotected API endpoint. The vulnerability exposed user email addresses and telephone numbers. The issue was classified under CWE-312 with a CVSS score of 6.1. The vulnerability was successfully reproduced, validated, and subsequently remediated.",
+      "disclosedAt": "2026-02-24T20:40:10.523Z",
+      "programHandle": "mars",
+      "programName": "Mars",
+      "reporterUsername": "prakhar0x01",
+      "url": "https://hackerone.com/reports/3376598",
+      "fetchedAt": "2026-03-07T16:12:49.889Z"
+    },
+    {
+      "id": "3066548",
+      "title": "███████ - Publicly Accessible public_html Directory Exposing WordPress Configuration",
+      "severity": "medium",
+      "cweId": "CWE-200",
+      "cweName": "Information Disclosure",
+      "cveIds": [],
+      "summary": "A publicly accessible directory containing sensitive WordPress configuration files, including database credentials, authentication keys, and API secrets, was discovered. The vulnerability allowed unauthorized access to critical system information through a downloadable zip file. The security team validated the report, coordinated remediation, and confirmed the issue was resolved.",
+      "disclosedAt": "2026-02-24T20:27:02.664Z",
+      "programHandle": "mars",
+      "programName": "Mars",
+      "reporterUsername": "xgoon",
+      "url": "https://hackerone.com/reports/3066548",
+      "fetchedAt": "2026-03-07T16:12:49.889Z"
+    },
+    {
+      "id": "3293803",
+      "title": "SQLi At `███████` via `theme_name` ",
+      "severity": "critical",
+      "cweId": "CWE-89",
+      "cweName": "SQL Injection",
+      "cveIds": [],
+      "summary": "A SQL injection vulnerability was discovered in a web application's theme selection endpoint through the \"theme_name\" parameter. Using SQLMap, the vulnerability was demonstrated to be exploitable through both error-based and time-based blind injection attacks against a MySQL database (version 5.1 or newer). The exploitation successfully enumerated several databases, including sensitive repositories for authentication, payment, and security data. The development team implemented fixes using parameterized queries and input validation, and post-remediation testing confirmed the vulnerability was fully resolved.",
+      "disclosedAt": "2026-02-24T19:49:26.815Z",
+      "programHandle": "mars",
+      "programName": "Mars",
+      "reporterUsername": "4ksh3ye",
+      "url": "https://hackerone.com/reports/3293803",
+      "fetchedAt": "2026-03-07T16:12:51.273Z"
+    },
+    {
+      "id": "3277276",
+      "title": "SQLi at █████ parameter",
+      "severity": "critical",
+      "cweId": "CWE-89",
+      "cweName": "SQL Injection",
+      "cveIds": [],
+      "summary": "A SQL injection vulnerability was discovered in an items endpoint that accepted unauthenticated POST requests without CSRF validation. The vulnerability allowed execution of arbitrary SQL commands and extraction of database metadata. Additional security issues included stored XSS through the description parameter and lack of authentication controls. The vulnerability was promptly remediated by the security team.",
+      "disclosedAt": "2026-02-24T19:43:28.252Z",
+      "programHandle": "mars",
+      "programName": "Mars",
+      "reporterUsername": "scriptsavvy",
+      "url": "https://hackerone.com/reports/3277276",
+      "fetchedAt": "2026-03-07T16:12:51.273Z"
+    },
+    {
+      "id": "3174778",
+      "title": " No Rate Limiting on Password Attempts After Insecure Registration Flow cause ATO",
+      "severity": "medium",
+      "cweId": null,
+      "cweName": "Improper Restriction of Authentication Attempts",
+      "cveIds": [],
+      "summary": "An authentication vulnerability was identified that lacked rate limiting controls on password attempts. The flaw allowed unlimited brute force attacks against user accounts without triggering security measures. Attackers could perform consecutive password attempts and distinguish successful authentications through session cookie presence in responses. The vulnerability enabled automated credential validation attacks. The development team successfully remediated the issue by implementing proper rate limiting mechanisms and security controls.",
+      "disclosedAt": "2026-02-24T19:37:02.785Z",
+      "programHandle": "mars",
+      "programName": "Mars",
+      "reporterUsername": "azar_man",
+      "url": "https://hackerone.com/reports/3174778",
+      "fetchedAt": "2026-03-07T16:12:51.273Z"
+    },
+    {
+      "id": "3456148",
+      "title": "Unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
+      "severity": "medium",
+      "cweId": null,
+      "cweName": null,
+      "cveIds": [],
+      "summary": "A vulnerability was discovered in the Fetch API of Node.js that allowed an unbounded number of links in the decompression chain for HTTP responses. This could lead to resource exhaustion, as the default `maxHeaderSize` allowed a malicious server to insert thousands of compression steps, resulting in high CPU usage and excessive memory allocation on the client side.",
+      "disclosedAt": "2026-02-23T16:02:30.926Z",
+      "programHandle": "nodejs",
+      "programName": "Node.js",
+      "reporterUsername": "illia-v",
+      "url": "https://hackerone.com/reports/3456148",
+      "fetchedAt": "2026-03-07T16:12:55.932Z"
+    },
+    {
+      "id": "3042475",
+      "title": "Splatoon 3 Anticheat Seed Randomization Weakness",
+      "severity": "medium",
+      "cweId": null,
+      "cweName": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
+      "cveIds": [],
+      "summary": "A weakness in the anticheat seed randomization implementation of Splatoon 3 was discovered. The vulnerability allowed the predictability of the seed used for anticheat checks, potentially undermining the intended security measures.",
+      "disclosedAt": "2026-02-19T00:37:20.109Z",
+      "programHandle": "nintendo",
+      "programName": "Nintendo",
+      "reporterUsername": "hana2736",
+      "url": "https://hackerone.com/reports/3042475",
+      "fetchedAt": "2026-03-07T16:13:07.780Z"
+    },
+    {
+      "id": "3463719",
+      "title": "ASLR leak in Mario Kart World through LAN mode",
+      "severity": "high",
+      "cweId": "CWE-200",
+      "cweName": "Information Disclosure",
+      "cveIds": [],
+      "summary": "A vulnerability was discovered in the LAN mode of Mario Kart World that allowed an ASLR leak. This vulnerability was found in the game's software.",
+      "disclosedAt": "2026-02-19T00:36:24.466Z",
+      "programHandle": "nintendo",
+      "programName": "Nintendo",
+      "reporterUsername": "kinnay",
+      "url": "https://hackerone.com/reports/3463719",
+      "fetchedAt": "2026-03-07T16:13:07.780Z"
+    },
+    {
+      "id": "3447021",
+      "title": "XSS Vulnerability on Pressable/Atomic Hosting Platform via unescaped admin notices leads to code execution",
+      "severity": "medium",
+      "cweId": null,
+      "cweName": null,
+      "cveIds": [],
+      "summary": "A cross-site scripting (XSS) vulnerability was discovered in the Pressable/Atomic Hosting Platform's admin notices feature. Unescaped text output in the `atomic-platform.php` file allowed arbitrary JavaScript code execution when an administrator updated or set the `atomic_single_option_limiter_notices` option with a malicious payload.",
+      "disclosedAt": "2026-02-18T14:19:07.458Z",
+      "programHandle": "automattic",
+      "programName": "Automattic",
+      "reporterUsername": "georgestephanis",
+      "url": "https://hackerone.com/reports/3447021",
+      "fetchedAt": "2026-03-07T16:13:11.241Z"
+    }
+  ],
+  "sigmaRules": [
+    {
+      "id": "a91d74a0-225c-412c-9d88-b2d6978c862c",
+      "yamlContent": "title: Potential Code Injection Attack\nid: a91d74a0-225c-412c-9d88-b2d6978c862c\nstatus: experimental\ndescription: |\n  \"Potential Code Injection attack detected. Auto-generated from HackerOne report: Injection in path parameter of Ingress-nginx\"\n  Auto-generated from HackerOne report analysis.\nreferences:\n  - https://hackerone.com/reports/2701701\nauthor: Panguard Threat Intel (auto-generated)\ndate: 2026/03/07\ntags:\n  - attack.execution\n  - attack.t1059\n  - cwe.94\nlogsource:\n  category: webserver\ndetection:\n  selection:\n    cs-uri-query|contains:\n      - 'eval('\n      - 'exec('\n      - 'system('\n      - '__import__'\n      - 'Runtime.getRuntime()'\n      - 'Process'\n      - 'spawn('\n      - 'require('\n  condition: selection\nfalsepositives:\n  - Legitimate internal API calls\n  - Development/testing environments\nlevel: medium",
+      "sourceReportId": "2701701",
+      "sourceReportUrl": "https://hackerone.com/reports/2701701",
+      "attackType": "Code Injection",
+      "confidence": 75,
+      "status": "experimental",
+      "generatedAt": "2026-03-07T16:13:26.244Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "cda6b9d9-cb05-4efb-9ab2-3d03bcfe4f4f",
+      "yamlContent": "title: Potential Insecure Direct Object Reference\nid: cda6b9d9-cb05-4efb-9ab2-3d03bcfe4f4f\nstatus: experimental\ndescription: |\n  \"Potential IDOR attack detected. Auto-generated from HackerOne report: IDOR to make someone attend or leave an event\"\n  Auto-generated from HackerOne report analysis.\nreferences:\n  - https://hackerone.com/reports/1734639\nauthor: Panguard Threat Intel (auto-generated)\ndate: 2026/03/07\ntags:\n  - attack.defense_evasion\n  - attack.t1078\n  - cwe.639\nlogsource:\n  category: webserver\ndetection:\n  selection:\n    cs-uri-query|contains:\n      - '/users/'\n      - '/account/'\n      - '/profile/'\n      - '/order/'\n      - '/api/v'\n  condition: selection\nfalsepositives:\n  - Legitimate internal API calls\n  - Development/testing environments\nlevel: medium",
+      "sourceReportId": "1734639",
+      "sourceReportUrl": "https://hackerone.com/reports/1734639",
+      "attackType": "IDOR",
+      "confidence": 60,
+      "status": "draft",
+      "generatedAt": "2026-03-07T16:13:26.249Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "c9b9a0ce-ab2d-43c4-98bb-8c6713b420ec",
+      "yamlContent": "title: Potential Open Redirect Attempt\nid: c9b9a0ce-ab2d-43c4-98bb-8c6713b420ec\nstatus: experimental\ndescription: |\n  \"Potential Open Redirect attack detected. Auto-generated from HackerOne report: Open Redirect on lovable.dev via redirect parameter leads to phishing attacks\"\n  Auto-generated from HackerOne report analysis.\nreferences:\n  - https://hackerone.com/reports/3581815\nauthor: Panguard Threat Intel (auto-generated)\ndate: 2026/03/07\ntags:\n  - attack.initial_access\n  - attack.t1566.002\nlogsource:\n  category: webserver\ndetection:\n  selection:\n    cs-uri-query|contains:\n      - '//evil.com'\n      - '/@evil.com'\n      - '/\\evil.com'\n      - '%0d%0a'\n  condition: selection\nfalsepositives:\n  - Legitimate internal API calls\n  - Development/testing environments\nlevel: medium",
+      "sourceReportId": "3581815",
+      "sourceReportUrl": "https://hackerone.com/reports/3581815",
+      "attackType": "Open Redirect",
+      "confidence": 60,
+      "status": "draft",
+      "generatedAt": "2026-03-07T16:13:26.251Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "7d255250-a5be-4e5f-b052-3e4c3491e203",
+      "yamlContent": "title: Potential OS Command Injection\nid: 7d255250-a5be-4e5f-b052-3e4c3491e203\nstatus: experimental\ndescription: |\n  \"Potential Command Injection attack detected. Auto-generated from HackerOne report: SSTI leads to Command injection\"\n  Auto-generated from HackerOne report analysis.\nreferences:\n  - https://hackerone.com/reports/3584149\nauthor: Panguard Threat Intel (auto-generated)\ndate: 2026/03/07\ntags:\n  - attack.execution\n  - attack.t1059\nlogsource:\n  category: webserver\ndetection:\n  selection:\n    cs-uri-query|contains:\n      - '$('\n      - '`'\n      - '|'\n      - ';'\n      - '&&'\n      - '||'\n      - '%0a'\n      - '\n'\n  condition: selection\nfalsepositives:\n  - Legitimate internal API calls\n  - Development/testing environments\nlevel: low",
+      "sourceReportId": "3584149",
+      "sourceReportUrl": "https://hackerone.com/reports/3584149",
+      "attackType": "Command Injection",
+      "confidence": 30,
+      "status": "draft",
+      "generatedAt": "2026-03-07T16:13:26.252Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "97a8015a-379c-4bb8-ac0b-50bfb2ea8af1",
+      "yamlContent": "title: Potential Cross-Site Scripting (XSS) Attempt\nid: 97a8015a-379c-4bb8-ac0b-50bfb2ea8af1\nstatus: experimental\ndescription: |\n  \"Potential XSS attack detected. Auto-generated from HackerOne report: AI Playground XSS to steal user-chat messages and access to connected MCP Server\"\n  Auto-generated from HackerOne report analysis.\nreferences:\n  - https://hackerone.com/reports/3424998\nauthor: Panguard Threat Intel (auto-generated)\ndate: 2026/03/07\ntags:\n  - attack.execution\n  - attack.t1059.007\nlogsource:\n  category: webserver\ndetection:\n  selection_query:\n    cs-uri-query|contains:\n      - '<script'\n      - 'javascript:'\n      - 'onerror='\n      - 'onload='\n      - '<img src='\n      - '<svg'\n  selection_body:\n    cs-body|contains:\n      - '<script'\n      - 'javascript:'\n      - 'onerror='\n      - 'onload='\n      - '<img src='\n      - '<svg'\n  condition: selection_query or selection_body\nfalsepositives:\n  - Legitimate internal API calls\n  - Development/testing environments\nlevel: low",
+      "sourceReportId": "3424998",
+      "sourceReportUrl": "https://hackerone.com/reports/3424998",
+      "attackType": "XSS",
+      "confidence": 45,
+      "status": "draft",
+      "generatedAt": "2026-03-07T16:13:26.253Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "668a20c1-e4eb-4e30-9f86-702a96c48bea",
+      "yamlContent": "title: Potential Information Disclosure Attack\nid: 668a20c1-e4eb-4e30-9f86-702a96c48bea\nstatus: experimental\ndescription: |\n  \"Potential Information Disclosure attack detected. Auto-generated from HackerOne report: Publicly accessible `█████████` endpoint exposing internal user identifiers and email addresses\"\n  Auto-generated from HackerOne report analysis.\nreferences:\n  - https://hackerone.com/reports/3360293\nauthor: Panguard Threat Intel (auto-generated)\ndate: 2026/03/07\ntags:\n  - attack.discovery\n  - attack.t1082\n  - cwe.200\nlogsource:\n  category: webserver\ndetection:\n  selection:\n    cs-uri-query|contains:\n      - '.env'\n      - '.git/'\n      - 'phpinfo'\n      - '/debug/'\n      - '/actuator'\n      - '/.well-known'\n  condition: selection\nfalsepositives:\n  - Legitimate internal API calls\n  - Development/testing environments\nlevel: medium",
+      "sourceReportId": "3360293",
+      "sourceReportUrl": "https://hackerone.com/reports/3360293",
+      "attackType": "Information Disclosure",
+      "confidence": 60,
+      "status": "draft",
+      "generatedAt": "2026-03-07T16:13:26.255Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "6cad1f41-dba0-4cae-aa96-362a709da4d2",
+      "yamlContent": "title: Potential SQL Injection Attempt\nid: 6cad1f41-dba0-4cae-aa96-362a709da4d2\nstatus: experimental\ndescription: |\n  \"Potential SQLi attack detected. Auto-generated from HackerOne report: SQLi At `███████` via `theme_name` \"\n  Auto-generated from HackerOne report analysis.\nreferences:\n  - https://hackerone.com/reports/3293803\nauthor: Panguard Threat Intel (auto-generated)\ndate: 2026/03/07\ntags:\n  - attack.initial_access\n  - attack.t1190\n  - cwe.89\nlogsource:\n  category: webserver\ndetection:\n  selection:\n    cs-uri-query|contains:\n      - ''' OR ''1''=''1'\n      - 'UNION SELECT'\n      - '''; DROP'\n      - '1=1--'\n      - ''' OR 1=1'\n      - 'admin''--'\n      - 'SLEEP('\n      - 'BENCHMARK('\n  condition: selection\nfalsepositives:\n  - Legitimate internal API calls\n  - Development/testing environments\nlevel: high",
+      "sourceReportId": "3293803",
+      "sourceReportUrl": "https://hackerone.com/reports/3293803",
+      "attackType": "SQLi",
+      "confidence": 85,
+      "status": "experimental",
+      "generatedAt": "2026-03-07T16:13:26.260Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    }
+  ],
+  "yaraRules": [
+    {
+      "id": "panguard_code_injection_2701701",
+      "ruleContent": "rule panguard_code_injection_2701701\n{\n    meta:\n        description = \"Detects code injection payloads in files or network captures\"\n        author = \"Panguard Threat Intel (auto-generated)\"\n        date = \"2026-03-07\"\n        reference = \"https://hackerone.com/reports/2701701\"\n        report_title = \"Injection in path parameter of Ingress-nginx\"\n        confidence = 75\n        cwe = \"CWE-94\"\n        mitre = \"T1059\"\n\n    strings:\n        $eval_call = \"eval(\" nocase\n        $exec_call = \"exec(\" nocase\n        $system_call = \"system(\" nocase\n        $spawn_call = \"spawn(\" nocase\n        $runtime_exec = \"Runtime.getRuntime()\" nocase\n        $python_import = \"__import__\" nocase\n\n    condition:\n        2 of them\n}",
+      "sourceReportId": "2701701",
+      "sourceReportUrl": "https://hackerone.com/reports/2701701",
+      "attackType": "Code Injection",
+      "confidence": 75,
+      "status": "experimental",
+      "generatedAt": "2026-03-07T16:13:26.248Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "panguard_command_injection_3584149",
+      "ruleContent": "rule panguard_command_injection_3584149\n{\n    meta:\n        description = \"Detects OS command injection patterns\"\n        author = \"Panguard Threat Intel (auto-generated)\"\n        date = \"2026-03-07\"\n        reference = \"https://hackerone.com/reports/3584149\"\n        report_title = \"SSTI leads to Command injection\"\n        confidence = 30\n        mitre = \"T1059\"\n\n    strings:\n        $cmd_pipe = \"/bin/sh -c\" nocase\n        $cmd_bash = \"/bin/bash -c\" nocase\n        $cmd_powershell = \"powershell.exe\" nocase\n        $cmd_exec = \"cmd.exe /c\" nocase\n        $backtick_exec = /`[^`]{2,40}`/ nocase\n\n    condition:\n        3 of them\n}",
+      "sourceReportId": "3584149",
+      "sourceReportUrl": "https://hackerone.com/reports/3584149",
+      "attackType": "Command Injection",
+      "confidence": 30,
+      "status": "draft",
+      "generatedAt": "2026-03-07T16:13:26.252Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "panguard_xss_3424998",
+      "ruleContent": "rule panguard_xss_3424998\n{\n    meta:\n        description = \"Detects cross-site scripting payloads\"\n        author = \"Panguard Threat Intel (auto-generated)\"\n        date = \"2026-03-07\"\n        reference = \"https://hackerone.com/reports/3424998\"\n        report_title = \"AI Playground XSS to steal user-chat messages and access to connected MCP Server\"\n        confidence = 45\n        mitre = \"T1059.007\"\n\n    strings:\n        $script_tag = \"<script\" nocase\n        $javascript_proto = \"javascript:\" nocase\n        $onerror_handler = \"onerror=\" nocase\n        $onload_handler = \"onload=\" nocase\n        $document_cookie = \"document.cookie\" nocase\n        $svg_tag = \"<svg/onload=\" nocase\n\n    condition:\n        3 of them\n}",
+      "sourceReportId": "3424998",
+      "sourceReportUrl": "https://hackerone.com/reports/3424998",
+      "attackType": "XSS",
+      "confidence": 45,
+      "status": "draft",
+      "generatedAt": "2026-03-07T16:13:26.254Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "panguard_information_disclosure_3360293",
+      "ruleContent": "rule panguard_information_disclosure_3360293\n{\n    meta:\n        description = \"Detects information disclosure patterns\"\n        author = \"Panguard Threat Intel (auto-generated)\"\n        date = \"2026-03-07\"\n        reference = \"https://hackerone.com/reports/3360293\"\n        report_title = \"Publicly accessible `█████████` endpoint exposing internal user identifiers and email addresses\"\n        confidence = 60\n        cwe = \"CWE-200\"\n        mitre = \"T1082\"\n\n    strings:\n        $env_file = \".env\" nocase\n        $git_dir = \".git/config\" nocase\n        $phpinfo = \"phpinfo()\" nocase\n        $actuator = \"/actuator/\" nocase\n        $debug_endpoint = \"/debug/\" nocase\n\n    condition:\n        3 of them\n}",
+      "sourceReportId": "3360293",
+      "sourceReportUrl": "https://hackerone.com/reports/3360293",
+      "attackType": "Information Disclosure",
+      "confidence": 60,
+      "status": "draft",
+      "generatedAt": "2026-03-07T16:13:26.258Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "panguard_information_disclosure_3066548",
+      "ruleContent": "rule panguard_information_disclosure_3066548\n{\n    meta:\n        description = \"Detects information disclosure patterns\"\n        author = \"Panguard Threat Intel (auto-generated)\"\n        date = \"2026-03-07\"\n        reference = \"https://hackerone.com/reports/3066548\"\n        report_title = \"███████ - Publicly Accessible public_html Directory Exposing WordPress Configuration\"\n        confidence = 60\n        cwe = \"CWE-200\"\n        mitre = \"T1082\"\n\n    strings:\n        $env_file = \".env\" nocase\n        $git_dir = \".git/config\" nocase\n        $phpinfo = \"phpinfo()\" nocase\n        $actuator = \"/actuator/\" nocase\n        $debug_endpoint = \"/debug/\" nocase\n\n    condition:\n        3 of them\n}",
+      "sourceReportId": "3066548",
+      "sourceReportUrl": "https://hackerone.com/reports/3066548",
+      "attackType": "Information Disclosure",
+      "confidence": 60,
+      "status": "draft",
+      "generatedAt": "2026-03-07T16:13:26.259Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "panguard_sqli_3293803",
+      "ruleContent": "rule panguard_sqli_3293803\n{\n    meta:\n        description = \"Detects SQL injection attack patterns\"\n        author = \"Panguard Threat Intel (auto-generated)\"\n        date = \"2026-03-07\"\n        reference = \"https://hackerone.com/reports/3293803\"\n        report_title = \"SQLi At `███████` via `theme_name` \"\n        confidence = 85\n        cwe = \"CWE-89\"\n        mitre = \"T1190\"\n\n    strings:\n        $union_select = \"UNION SELECT\" nocase\n        $or_true = \"' OR '1'='1\" nocase\n        $comment_dash = \"1=1--\" nocase\n        $sleep_func = \"SLEEP(\" nocase\n        $benchmark_func = \"BENCHMARK(\" nocase\n        $waitfor_delay = \"WAITFOR DELAY\" nocase\n\n    condition:\n        2 of them\n}",
+      "sourceReportId": "3293803",
+      "sourceReportUrl": "https://hackerone.com/reports/3293803",
+      "attackType": "SQLi",
+      "confidence": 85,
+      "status": "experimental",
+      "generatedAt": "2026-03-07T16:13:26.261Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "panguard_sqli_3277276",
+      "ruleContent": "rule panguard_sqli_3277276\n{\n    meta:\n        description = \"Detects SQL injection attack patterns\"\n        author = \"Panguard Threat Intel (auto-generated)\"\n        date = \"2026-03-07\"\n        reference = \"https://hackerone.com/reports/3277276\"\n        report_title = \"SQLi at █████ parameter\"\n        confidence = 85\n        cwe = \"CWE-89\"\n        mitre = \"T1190\"\n\n    strings:\n        $union_select = \"UNION SELECT\" nocase\n        $or_true = \"' OR '1'='1\" nocase\n        $comment_dash = \"1=1--\" nocase\n        $sleep_func = \"SLEEP(\" nocase\n        $benchmark_func = \"BENCHMARK(\" nocase\n        $waitfor_delay = \"WAITFOR DELAY\" nocase\n\n    condition:\n        2 of them\n}",
+      "sourceReportId": "3277276",
+      "sourceReportUrl": "https://hackerone.com/reports/3277276",
+      "attackType": "SQLi",
+      "confidence": 85,
+      "status": "experimental",
+      "generatedAt": "2026-03-07T16:13:26.261Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "panguard_command_injection_3456148",
+      "ruleContent": "rule panguard_command_injection_3456148\n{\n    meta:\n        description = \"Detects OS command injection patterns\"\n        author = \"Panguard Threat Intel (auto-generated)\"\n        date = \"2026-03-07\"\n        reference = \"https://hackerone.com/reports/3456148\"\n        report_title = \"Unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion\"\n        confidence = 60\n        mitre = \"T1059\"\n\n    strings:\n        $cmd_pipe = \"/bin/sh -c\" nocase\n        $cmd_bash = \"/bin/bash -c\" nocase\n        $cmd_powershell = \"powershell.exe\" nocase\n        $cmd_exec = \"cmd.exe /c\" nocase\n        $backtick_exec = /`[^`]{2,40}`/ nocase\n\n    condition:\n        3 of them\n}",
+      "sourceReportId": "3456148",
+      "sourceReportUrl": "https://hackerone.com/reports/3456148",
+      "attackType": "Command Injection",
+      "confidence": 60,
+      "status": "draft",
+      "generatedAt": "2026-03-07T16:13:26.262Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "panguard_information_disclosure_3463719",
+      "ruleContent": "rule panguard_information_disclosure_3463719\n{\n    meta:\n        description = \"Detects information disclosure patterns\"\n        author = \"Panguard Threat Intel (auto-generated)\"\n        date = \"2026-03-07\"\n        reference = \"https://hackerone.com/reports/3463719\"\n        report_title = \"ASLR leak in Mario Kart World through LAN mode\"\n        confidence = 75\n        cwe = \"CWE-200\"\n        mitre = \"T1082\"\n\n    strings:\n        $env_file = \".env\" nocase\n        $git_dir = \".git/config\" nocase\n        $phpinfo = \"phpinfo()\" nocase\n        $actuator = \"/actuator/\" nocase\n        $debug_endpoint = \"/debug/\" nocase\n\n    condition:\n        2 of them\n}",
+      "sourceReportId": "3463719",
+      "sourceReportUrl": "https://hackerone.com/reports/3463719",
+      "attackType": "Information Disclosure",
+      "confidence": 75,
+      "status": "experimental",
+      "generatedAt": "2026-03-07T16:13:26.262Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    },
+    {
+      "id": "panguard_xss_3447021",
+      "ruleContent": "rule panguard_xss_3447021\n{\n    meta:\n        description = \"Detects cross-site scripting payloads\"\n        author = \"Panguard Threat Intel (auto-generated)\"\n        date = \"2026-03-07\"\n        reference = \"https://hackerone.com/reports/3447021\"\n        report_title = \"XSS Vulnerability on Pressable/Atomic Hosting Platform via unescaped admin notices leads to code execution\"\n        confidence = 60\n        mitre = \"T1059.007\"\n\n    strings:\n        $script_tag = \"<script\" nocase\n        $javascript_proto = \"javascript:\" nocase\n        $onerror_handler = \"onerror=\" nocase\n        $onload_handler = \"onload=\" nocase\n        $document_cookie = \"document.cookie\" nocase\n        $svg_tag = \"<svg/onload=\" nocase\n\n    condition:\n        3 of them\n}",
+      "sourceReportId": "3447021",
+      "sourceReportUrl": "https://hackerone.com/reports/3447021",
+      "attackType": "XSS",
+      "confidence": 60,
+      "status": "draft",
+      "generatedAt": "2026-03-07T16:13:26.263Z",
+      "reviewed": false,
+      "reviewDecision": "pending"
+    }
+  ]
+}