agent-threat-rules 3.5.3 → 3.5.5

package/rules/privilege-escalation/ATR-2026-01949-praisonai-mcpserver-unauth-tools-call.yaml

@@ -0,0 +1,138 @@
+title: "PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)"
+id: ATR-2026-01949
+rule_version: 1
+status: draft
+description: >
+  Detects exploitation of GHSA-j4f3-55x4-r6q2 (CRITICAL) in npm praisonai
+  >=1.5.0,<=1.7.1: the MCPServer's handleRequest() in src/praisonai-ts/src/mcp/server.ts
+  dispatches privileged JSON-RPC methods (tools/call, tools/list, resources/read,
+  prompts/get) without invoking the unused MCPSecurity manager, so unauthenticated
+  HTTP POSTs — including ones sent with no Authorization header or a bogus
+  "Authorization: Bearer invalid" — return HTTP 200 and execute registered tools.
+  This rule keys on the unauthenticated PraisonAI/MCP tools/call payload, the
+  invalid-Bearer auth-bypass token, and the vulnerable handleRequest sink.
+author: "ATR Community"
+date: "2026/06/29"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1190 - Exploit Public-Facing Application"
+  cve:
+    - "GHSA-j4f3-55x4-r6q2"
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+      strength: secondary
+tags:
+  category: privilege-escalation
+  subcategory: mcp-auth-bypass
+  scan_target: both
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: praisonai-ghsa-j4f3-55x4-r6q2
+agent_source:
+  type: llm_io
+  framework:
+    - praisonai
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  false_positives:
+    - "Legitimate authenticated MCP client sending a tools/call request with a valid Authorization header."
+    - "MCP protocol documentation describing the tools/call JSON-RPC method without the unauthenticated bypass framing."
+    - "Mitigation advisory recommending an upgrade to praisonai >= 1.7.2 without exploit content."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)(?:praisonai|mcpserver|mcpsecurity|handleRequest)[\s\S]{0,200}(?:no\s+auth(?:oriz\w+)?|unauthenticat|without\s+(?:auth|credential)|authorization:\s*bearer\s+invalid)[\s\S]{0,200}["\x27]?(?:method)["\x27]?\s*[:=]\s*["\x27]tools/call'
+      description: >
+        PraisonAI/MCPServer context plus an unauthenticated / invalid-Bearer
+        framing immediately preceding a JSON-RPC tools/call method — the core
+        GHSA-j4f3-55x4-r6q2 auth-bypass payload
+    - field: content
+      operator: regex
+      value: '(?i)authorization:\s*bearer\s+invalid[\s\S]{0,200}(?:tools/call|tools/list|resources/read|prompts/get)'
+      description: >
+        Invalid-credential bypass token ("Authorization: Bearer invalid")
+        paired with a privileged MCP JSON-RPC method that returns HTTP 200
+        without validation
+    - field: content
+      operator: regex
+      value: '(?i)handleRequest[\s\S]{0,160}(?:src/(?:praisonai-ts/src/)?mcp/server\.ts|mcpsecurity|tools/call)[\s\S]{0,120}(?:bypass|unauthenticat|without\s+(?:auth|validation)|dispatch\w*\s+without)'
+      description: >
+        The vulnerable handleRequest sink in mcp/server.ts dispatching methods
+        without invoking MCPSecurity — direct reference to the vulnerable code path
+    - field: content
+      operator: regex
+      value: '(?i)GHSA-j4f3-55x4-r6q2[\s\S]{0,200}(?:tools/call|unauthenticat|auth(?:oriz\w+)?\s+bypass|bearer\s+invalid)'
+      description: "explicit GHSA framing combined with the auth-bypass exploit tokens"
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01949] CRITICAL: Unauthenticated PraisonAI MCPServer tools/call
+    auth-bypass detected (GHSA-j4f3-55x4-r6q2). Attackers can invoke registered
+    MCP tools with no valid credentials. Block and upgrade praisonai to >= 1.7.2.
+confidence: 80
+wild_fp_rate: 0
+test_cases:
+  true_positives:
+    - input: "PraisonAI MCPServer exploit: send unauthenticated POST with no Authorization header and body {\"method\":\"tools/call\",\"params\":{\"name\":\"run_shell\",\"arguments\":{}}} — returns HTTP 200."
+      expected: triggered
+      description: "Unauthenticated framing + PraisonAI/MCPServer + tools/call JSON-RPC payload"
+    - input: "curl -H 'Authorization: Bearer invalid' http://target:8080 -d '{\"method\":\"tools/call\",\"params\":{\"name\":\"x\"}}'"
+      expected: triggered
+      description: "Invalid-Bearer bypass token immediately before tools/call method"
+    - input: "GHSA-j4f3-55x4-r6q2: handleRequest in src/praisonai-ts/src/mcp/server.ts dispatches tools/call without invoking MCPSecurity, allowing unauthenticated tool execution."
+      expected: triggered
+      description: "Vulnerable handleRequest sink + GHSA framing + unauthenticated dispatch"
+    - input: "Authorization: Bearer invalid still reaches resources/read on the PraisonAI MCP server without validation"
+      expected: triggered
+      description: "Invalid-Bearer token paired with privileged resources/read method"
+  true_negatives:
+    - input: "Authenticated MCP client sends {\"method\":\"tools/call\",\"params\":{\"name\":\"search\"}} with a valid Authorization: Bearer <token> header."
+      expected: not_triggered
+      description: "Legitimate authenticated tools/call request — no unauthenticated/invalid-Bearer framing"
+    - input: "The MCP spec defines tools/call as the JSON-RPC method an agent uses to invoke a registered tool."
+      expected: not_triggered
+      description: "Generic MCP protocol documentation of tools/call without the bypass tokens"
+    - input: "Upgrade praisonai to >= 1.7.2 to remediate the MCPServer authentication issue."
+      expected: not_triggered
+      description: "Mitigation advice without any exploit payload or bypass token"
+    - input: "Our handleRequest function in server.ts logs each tools/call before forwarding it to the authenticated handler."
+      expected: not_triggered
+      description: "Benign handleRequest implementation that authenticates — lacks bypass/unauthenticated framing"

package/rules/privilege-escalation/ATR-2026-01974-anything-llm-data-import-access-control.yaml

@@ -0,0 +1,93 @@
+title: "AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)"
+id: ATR-2026-01974
+rule_version: 1
+status: draft
+description: >
+  CVE-2024-3279: improper access control on the mintplex-labs/anything-llm
+  POST /system/data-import endpoint (<1.0.0). An anonymous, unauthenticated
+  attacker uploads their own database file via multipart formData, deleting or
+  spoofing the existing anythingllm.db SQLite database to serve malicious data
+  or harvest user info. This rule keys on the data-import endpoint path combined
+  with the database-file import sink (anythingllm.db / data-import upload).
+author: "ATR Community"
+date: "2026/06/29"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+references:
+  owasp_llm: ["LLM06:2025 - Excessive Agency"]
+  owasp_agentic: ["ASI06:2026 - Tool Misuse"]
+  mitre_atlas: ["AML.T0049 - Exploit Public-Facing Application"]
+  mitre_attack: ["T1190 - Exploit Public-Facing Application"]
+  cve: ["CVE-2024-3279"]
+metadata_provenance: { mitre_atlas: human-reviewed, owasp_llm: human-reviewed, owasp_agentic: human-reviewed }
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+      strength: primary
+    - clause: "8.3"
+      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+      strength: secondary
+tags: { category: privilege-escalation, subcategory: improper-access-control, scan_target: both, confidence: high, source: cve-disclosure, vendor_sources: anything-llm-cve-2024-3279 }
+agent_source: { type: llm_io, framework: [any], provider: [any] }
+detection:
+  condition: any
+  false_positives:
+    - "Documentation or release notes describing the removed Export/Import feature without an actual unauthenticated upload request to /system/data-import"
+    - "Legitimate authenticated admin using a backup/restore tool that references anythingllm.db by path but does not POST it to the /system/data-import endpoint"
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)/system/data-import\b[\s\S]{0,300}(?:multipart/form-data|form-?data|multer|\.db\b|anythingllm\.db|method\s*[:=]\s*["'']?post)'
+      description: "POST upload to the unauthenticated /system/data-import endpoint with a multipart DB file"
+    - field: content
+      operator: regex
+      value: '(?i)anythingllm\.db[\s\S]{0,200}(?:/system/data-import|data-import|formData|multipart|import)'
+      description: "Import/upload of the anythingllm.db database file via the data-import sink"
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2024-3279[\s\S]{0,200}(?:data-import|anythingllm|access control|unauthenticated)'
+      description: "explicit CVE framing"
+response:
+  actions: [alert, block_input]
+  message_template: >
+    [ATR-2026-01974] CRITICAL: Unauthenticated AnythingLLM /system/data-import upload can overwrite/spoof anythingllm.db (CVE-2024-3279). Block and patch to >=1.0.0.
+confidence: 80
+wild_fp_rate: 0
+test_cases:
+  true_positives:
+    - input: "curl -X POST http://target:3001/api/system/data-import -F 'file=@evil.db' to overwrite anythingllm.db with no auth header"
+      expected: triggered
+      description: "Anonymous multipart POST to /system/data-import uploading a malicious database file"
+    - input: "fetch(`${API_BASE}/system/data-import`, { method: 'POST', body: formData }) // uploads attacker anythingllm.db, no auth"
+      expected: triggered
+      description: "Frontend-style unauthenticated data-import upload of the DB file"
+    - input: "Exploit for CVE-2024-3279: unauthenticated attacker imports their own anythingllm.db via /system/data-import to spoof the database"
+      expected: triggered
+      description: "Explicit CVE reference with the data-import access control bypass"
+  true_negatives:
+    - input: "Our admin docs explain how to back up anythingllm.db from the server/storage directory before upgrading."
+      expected: not_triggered
+      description: "Mentions anythingllm.db for backup but no data-import upload/POST sink"
+    - input: "The settings page used to have an Export or Import button; that feature was removed in v1.0.0 for security."
+      expected: not_triggered
+      description: "Describes the removed feature generically without the endpoint path or DB upload"
+    - input: "POST /api/workspace/upload with formData to add a multipart PDF document to a workspace for embedding."
+      expected: not_triggered
+      description: "A different multipart upload endpoint, not /system/data-import and not the DB file"

package/rules/privilege-escalation/ATR-2026-01981-network-ai-approval-inbox-unauth-cors-bypass.yaml

@@ -0,0 +1,152 @@
+title: "Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj)"
+id: ATR-2026-01981
+rule_version: 1
+status: draft
+description: >
+  Detects GHSA-mxjx-28vx-xjjj (CWE-862 Missing Authorization + CWE-352 CSRF via
+  wildcard CORS): network-ai's ApprovalInbox HTTP server (lib/approval-inbox.ts)
+  has no authentication of any kind and sets Access-Control-Allow-Origin: * on
+  every route, including the state-changing POST /approvals/:id/approve and
+  /deny. ApprovalInbox is the network surface of the human-in-the-loop Approval
+  Gate that gates high-risk operations (writes, shell commands, budget spend).
+  Any caller that can reach the inbox port — a co-located process, an SSRF, a
+  non-loopback remote client, or any website the operator visits in a browser
+  via the wildcard CORS — can enumerate pending approvals (GET /approvals/) and
+  approve them (POST /approvals/:id/approve) with no Authorization header,
+  defeating the Approval Gate so a gated shell command executes without
+  consent. Affected: network-ai <= 5.11.0.
+
+  Detection covers:
+  (a) a state-changing request to the approval control plane
+      (/approvals/<id>/approve or /deny) with no auth context, matching the
+      unauthenticated-client PoC shape;
+  (b) an enumeration request to the approval queue (GET /approvals/) paired
+      with the wildcard-CORS marker on the approval control plane;
+  (c) explicit GHSA-mxjx-28vx-xjjj / ApprovalInbox exploitation framing.
+
+  The detection target is the request shape at the approval control plane —
+  an unauthenticated approve/deny or enumerate call combined with the
+  wildcard-CORS marker — which is the exact bypass primitive, caught before
+  the gated action is released.
+author: "ATR Community"
+date: "2026/07/04"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: high
+
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI03:2026 - Privilege Compromise"
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1068 - Exploitation for Privilege Escalation"
+    - "T1190 - Exploit Public-Facing Application"
+  ghsa:
+    - "GHSA-mxjx-28vx-xjjj"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - { article: "15", context: "Article 15 cybersecurity — runtime detection of unauthenticated cross-origin approval-gate bypass on network-ai's ApprovalInbox control plane.", strength: primary }
+    - { article: "9",  context: "Article 9 risk management — runtime risk-treatment control for unauthenticated cross-origin approval-gate bypass.", strength: secondary }
+  nist_ai_rmf:
+    - { subcategory: "MP.5.1", context: "MAP 5.1 — adversarial input characterised/detected for unauthenticated cross-origin approval-gate bypass.", strength: primary }
+    - { subcategory: "MG.3.2", context: "MANAGE 3.2 — runtime monitoring control for unauthenticated cross-origin approval-gate bypass.", strength: secondary }
+  iso_42001:
+    - { clause: "8.1", context: "Clause 8.1 operational control — detection of unauthenticated cross-origin approval-gate bypass payload.", strength: primary }
+    - { clause: "8.3", context: "Clause 8.3 AI risk treatment — runtime detection as treatment control.", strength: secondary }
+
+tags:
+  category: privilege-escalation
+  subcategory: unauth-approval-gate-bypass
+  scan_target: tool_call
+  confidence: high
+  source: ghsa-disclosure
+  vendor_sources: network-ai-ghsa-mxjx-28vx-xjjj
+
+agent_source:
+  type: tool_call
+  framework:
+    - network-ai
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "Legitimate operator approving a pending action through an authenticated ApprovalInbox deployment that has been hardened with a reverse-proxy auth layer — expected to match; review confirms intent."
+    - "Security advisory or PR text quoting the GHSA-mxjx-28vx-xjjj PoC."
+    - "A read-only status check against an endpoint that is not the approvals control plane."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)POST\s+/approvals/[a-f0-9]+/(?:approve|deny)\b[\s\S]{0,300}(?:approvedBy["\x27]?\s*[:=]\s*["\x27]?(?:anonymous|attacker)|no\s+auth|Authorization["\x27]?\s*:\s*(?:null|undefined|absent|none))'
+      description: >
+        Unauthenticated POST to the approval control plane's approve/deny
+        route — approvedBy defaults to anonymous/attacker with no
+        Authorization header, matching the GHSA-mxjx-28vx-xjjj PoC shape.
+    - field: content
+      operator: regex
+      value: '(?i)GET\s+/approvals/\??(?:status=pending)?\b[\s\S]{0,200}Access-Control-Allow-Origin["\x27]?\s*:\s*["\x27]?\*'
+      description: >
+        Enumeration of the pending-approvals queue paired with a wildcard
+        Access-Control-Allow-Origin marker on the approval control plane —
+        the cross-origin approval-inbox reconnaissance step.
+    - field: content
+      operator: regex
+      value: '(?i)GHSA-mxjx-28vx-xjjj[\s\S]{0,200}(?:approval[- ]?inbox|network-ai|approve|CORS)'
+      description: >
+        Explicit GHSA-mxjx-28vx-xjjj reference combined with ApprovalInbox
+        exploitation language — attack framing in a skill or tool
+        description.
+
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01981] HIGH: network-ai ApprovalInbox unauthenticated
+    cross-origin approval bypass detected (GHSA-mxjx-28vx-xjjj, CWE-862 +
+    CWE-352). A caller with no Authorization header reached the approval
+    control plane's approve/deny or enumeration route, defeating the
+    human-in-the-loop Approval Gate. Block the request and upgrade network-ai
+    past 5.11.0 / put ApprovalInbox behind an authenticated reverse proxy.
+
+confidence: 78
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - tool_description: "POST /approvals/07d6f277efe35ac1/approve {\"approvedBy\": \"anonymous\"}"
+      expected: triggered
+      description: "Unauthenticated approve call defaults approvedBy to anonymous — GHSA-mxjx-28vx-xjjj PoC shape"
+    - tool_description: "GET /approvals/?status=pending -> 200, Access-Control-Allow-Origin: *"
+      expected: triggered
+      description: "Cross-origin enumeration of pending approvals via wildcard CORS marker"
+    - tool_description: "Exploiting GHSA-mxjx-28vx-xjjj: the network-ai ApprovalInbox has no auth, so I can approve any pending action via CORS."
+      expected: triggered
+      description: "Explicit GHSA-mxjx-28vx-xjjj ApprovalInbox exploitation framing"
+  true_negatives:
+    - tool_description: "POST /approvals/07d6f277efe35ac1/approve {\"approvedBy\": \"ops-lead\", \"Authorization\": \"Bearer sk_live_abc123\"}"
+      expected: not_triggered
+      description: "Authenticated operator approval with a Bearer token present"
+    - tool_description: "How does the ApprovalInbox approve/deny flow work in network-ai?"
+      expected: not_triggered
+      description: "General question about the feature, not an exploitation request"
+    - tool_description: "GET /approvals/health"
+      expected: not_triggered
+      description: "Read-only health check on an unrelated route, no wildcard CORS marker present"
+    - tool_description: "POST /approvals/07d6f277efe35ac1/approve {\"approvedBy\": \"ops-lead\"} behind an internal VPN with mTLS client cert required"
+      expected: not_triggered
+      description: "Approve call description explicitly noting mTLS-gated internal deployment, no anonymous/attacker/no-auth marker"

package/rules/privilege-escalation/ATR-2026-01986-windows-mcp-unauth-http-powershell-cors.yaml

@@ -0,0 +1,170 @@
+title: "Windows-MCP Unauthenticated HTTP PowerShell via Wildcard CORS (CVE-2026-48989)"
+id: ATR-2026-01986
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-48989 / GHSA-vrxg-gm77-7q5g (CWE-306 Missing Authentication
+  for Critical Function): Windows-MCP's SSE and Streamable HTTP transports
+  build the FastMCP control plane with no auth provider
+  (src/windows_mcp/__main__.py:75-113) and install blanket wildcard CORS
+  (allow_origins=*, allow_methods=*, allow_headers=*, __main__.py:37-42),
+  answering every OPTIONS preflight with the same wildcard headers regardless
+  of Origin. The same server registers the PowerShell tool
+  (src/windows_mcp/tools/shell.py:10-24), which executes caller-controlled
+  commands via PowerShell -EncodedCommand
+  (src/windows_mcp/desktop/powershell.py:176-204). A client that can reach
+  http://<host>:<port>/mcp — including a cross-origin browser page, since the
+  wildcard CORS grants it — can initialize an MCP session and call
+  tools/call for PowerShell with no credential of any kind, achieving
+  arbitrary PowerShell execution as the Windows user running Windows-MCP.
+  Affected: CursorTouch/Windows-MCP < 0.7.5; the default stdio transport is
+  not affected.
+
+  Detection covers:
+  (a) the OPTIONS preflight / control-plane response on the /mcp endpoint
+      carrying the wildcard access-control-allow-origin marker, which is the
+      structural precondition for the cross-origin bypass;
+  (b) a tools/call JSON-RPC request naming the PowerShell tool over the
+      HTTP/SSE control plane co-occurring with that wildcard-CORS marker;
+  (c) explicit CVE-2026-48989 / GHSA-vrxg-gm77-7q5g exploitation framing.
+
+  The detection target is the request/response shape at the MCP control
+  plane — a PowerShell tool invocation reachable through an unauthenticated,
+  wildcard-CORS-exposed /mcp endpoint — which is the exact remote-code-
+  execution primitive, caught before PowerShellExecutor.execute_command runs.
+  Bound to the PowerShell tool name plus the wildcard-CORS marker so a
+  legitimate, authenticated PowerShell call over a properly-scoped-CORS
+  deployment does not fire.
+author: "ATR Community"
+date: "2026/07/04"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI03:2026 - Privilege Compromise"
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0053 - LLM Plugin Compromise"
+  mitre_attack:
+    - "T1059 - Command and Scripting Interpreter"
+    - "T1190 - Exploit Public-Facing Application"
+  cve:
+    - "CVE-2026-48989"
+  ghsa:
+    - "GHSA-vrxg-gm77-7q5g"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - { article: "15", context: "Article 15 cybersecurity — runtime detection of unauthenticated cross-origin PowerShell tool invocation on Windows-MCP's HTTP control plane.", strength: primary }
+    - { article: "9",  context: "Article 9 risk management — runtime risk-treatment control for unauthenticated cross-origin PowerShell tool invocation.", strength: secondary }
+  nist_ai_rmf:
+    - { subcategory: "MP.5.1", context: "MAP 5.1 — adversarial input characterised/detected for unauthenticated cross-origin PowerShell tool invocation.", strength: primary }
+    - { subcategory: "MG.3.2", context: "MANAGE 3.2 — runtime monitoring control for unauthenticated cross-origin PowerShell tool invocation.", strength: secondary }
+  iso_42001:
+    - { clause: "8.1", context: "Clause 8.1 operational control — detection of unauthenticated cross-origin PowerShell tool invocation payload.", strength: primary }
+    - { clause: "8.3", context: "Clause 8.3 AI risk treatment — runtime detection as treatment control.", strength: secondary }
+
+tags:
+  category: privilege-escalation
+  subcategory: unauth-mcp-control-plane-rce
+  scan_target: mcp
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: windows-mcp-cve-2026-48989
+
+agent_source:
+  type: tool_call
+  framework:
+    - windows-mcp
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "A legitimate, authenticated PowerShell tool call over stdio transport or an HTTP deployment with an auth provider and origin-scoped CORS configured — expected to match if wildcard CORS markers are also present; review confirms intent."
+    - "Security advisory or PR text quoting the GHSA-vrxg-gm77-7q5g / CVE-2026-48989 PoC for review purposes."
+    - "An OPTIONS preflight response that scopes Access-Control-Allow-Origin to a specific trusted origin rather than a wildcard."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)OPTIONS\s+.{0,40}/mcp/?[\s\S]{0,200}access-control-allow-origin["\x27]?\s*:\s*["\x27]?\*[\s\S]{0,200}access-control-allow-methods["\x27]?\s*:\s*["\x27]?\*'
+      description: >
+        OPTIONS preflight against the /mcp control plane answered with
+        wildcard Access-Control-Allow-Origin and Access-Control-Allow-Methods
+        — the structural CORS-bypass precondition from GHSA-vrxg-gm77-7q5g.
+    - field: content
+      operator: regex
+      value: '(?i)"method"\s*:\s*"tools/call"[\s\S]{0,150}"name"\s*:\s*"PowerShell"[\s\S]{0,300}access-control-allow-origin["\x27]?\s*:\s*["\x27]?\*'
+      description: >
+        A tools/call JSON-RPC request naming the PowerShell tool
+        co-occurring with a wildcard access-control-allow-origin marker on
+        the same MCP exchange — unauthenticated cross-origin PowerShell
+        invocation.
+    - field: content
+      operator: regex
+      value: '(?i)access-control-allow-origin["\x27]?\s*:\s*["\x27]?\*[\s\S]{0,300}\bPowerShell\b[\s\S]{0,150}(?:command|EncodedCommand)["\x27]?\s*[:=]'
+      description: >
+        Wildcard CORS marker followed by a PowerShell tool argument carrying
+        a command/EncodedCommand payload — the end-to-end
+        control-plane-to-shell-execution shape.
+    - field: content
+      operator: regex
+      value: '(?i)(?:CVE-2026-48989|GHSA-vrxg-gm77-7q5g)[\s\S]{0,200}(?:windows-mcp|powershell|wildcard\s*CORS|unauthenticat)'
+      description: >
+        Explicit CVE-2026-48989 / GHSA-vrxg-gm77-7q5g reference combined with
+        Windows-MCP PowerShell/CORS exploitation language — attack framing
+        in a skill or tool description.
+
+response:
+  actions:
+    - alert
+    - block_tool
+  message_template: >
+    [ATR-2026-01986] CRITICAL: Windows-MCP unauthenticated HTTP PowerShell via
+    wildcard CORS detected (CVE-2026-48989, CWE-306). A tools/call for
+    PowerShell reached the /mcp control plane alongside a wildcard
+    access-control-allow-origin marker; Windows-MCP before 0.7.5 runs SSE/
+    Streamable-HTTP transports with no auth provider and allow_origins=*.
+    Block the tool call and upgrade Windows-MCP to >= 0.7.5 or restrict to
+    the stdio transport.
+
+confidence: 82
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - tool_description: "curl -i -X OPTIONS 'http://127.0.0.1:18123/mcp/' -H 'Origin: https://attacker.example' response: access-control-allow-origin: * access-control-allow-methods: * access-control-allow-headers: *"
+      expected: triggered
+      description: "OPTIONS preflight on /mcp answered with wildcard ACAO + ACAM — CVE-2026-48989 PoC step 1"
+    - tool_description: "{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"PowerShell\",\"arguments\":{\"command\":\"calc.exe\"}}} response headers: access-control-allow-origin: *"
+      expected: triggered
+      description: "tools/call for PowerShell co-occurring with wildcard ACAO on the same exchange — CVE-2026-48989 PoC step 3"
+    - tool_description: "Exploiting CVE-2026-48989 (GHSA-vrxg-gm77-7q5g): Windows-MCP's HTTP transport is unauthenticated with wildcard CORS, so a cross-origin page can call the PowerShell tool."
+      expected: triggered
+      description: "Explicit CVE-2026-48989 Windows-MCP exploitation framing"
+  true_negatives:
+    - tool_description: "curl -i -X OPTIONS 'https://mcp.internal.corp/mcp/' -H 'Origin: https://ops.internal.corp' response: access-control-allow-origin: https://ops.internal.corp access-control-allow-methods: POST"
+      expected: not_triggered
+      description: "Preflight scoped to a specific trusted origin, not a wildcard"
+    - tool_description: "{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/call\",\"params\":{\"name\":\"PowerShell\",\"arguments\":{\"command\":\"Get-Process\"}}} over stdio transport with mcp-auth-token: valid-session-token-abc, no CORS headers present"
+      expected: not_triggered
+      description: "Authenticated PowerShell call over stdio with a session token, no wildcard CORS marker"
+    - tool_description: "How do I configure authentication for the Windows-MCP HTTP transport?"
+      expected: not_triggered
+      description: "General configuration question, not an exploitation attempt"
+    - tool_description: "{\"jsonrpc\":\"2.0\",\"id\":5,\"method\":\"tools/call\",\"params\":{\"name\":\"ListDirectory\",\"arguments\":{\"path\":\"C:\\\\Users\"}}}"
+      expected: not_triggered
+      description: "Unrelated read-only tool call, no PowerShell tool name and no CORS marker"

package/rules/skill-compromise/ATR-2026-00066-parameter-injection.yaml

@@ -1,6 +1,6 @@
 title: "Parameter Injection via Tool Arguments"
 id: ATR-2026-00066
-rule_version: 1
+rule_version: 2
 status: experimental
 description: >
   Detects injection attacks delivered through MCP tool arguments. An attacker
@@ -78,7 +78,7 @@ detection:
   conditions:
     - field: tool_args
       operator: regex
-      value: "(?i)(;|&&|\\|\\||`|\\$\\()\\s*(cat|ls|id|whoami|uname|pwd|env|curl|wget|nc|bash|sh|python)"
+      value: "(?i)(;|&&|\\|\\||`|\\$\\()\\s*(whoami|\\bid\\b|uname\\s+-a|curl\\s+(?:-\\S+\\s+)*https?://(?!localhost|127\\.)|wget\\s+https?://(?!localhost|127\\.)|\\bnc\\b\\s|ncat\\s|cat\\s+/etc/(?:passwd|shadow|sudoers)|\\b(?:ba)?sh\\s+-[ic]|python[0-9]?\\s+-c|base64\\s+-d|rm\\s+-[rf])"
     - field: tool_args
       operator: regex
       value: "(?i)('\\s*(OR|AND|UNION)\\s+'|'?\\s*;\\s*(DROP|DELETE|INSERT|UPDATE|ALTER|CREATE)\\s|--\\s*[;\\\"'\\)\\]]|/\\*.*\\*/)"

package/rules/tool-poisoning/ATR-2026-00012-unauthorized-tool-call.yaml

@@ -1,6 +1,6 @@
 title: Unauthorized Tool Call Detection
 id: ATR-2026-00012
-rule_version: 1
+rule_version: 2
 status: experimental
 description: >
   Detects unauthorized or malicious tool call attempts including parameter injection, path traversal, shell injection in
@@ -74,8 +74,8 @@ detection:
     - field: tool_args
       operator: regex
       value: >-
-        (;|&&|\|\||\$\(|`|\|\s*\w)\s*.{0,50}(curl|wget|nc|ncat|bash|sh|zsh|python|ruby|perl|node|php|powershell|cmd|eval|exec|system|rm\s+-|cat\s+/etc|whoami|id\b|uname|hostname|ifconfig|ipconfig|net\s+user|net\s+localgroup)
-      description: Shell metacharacter injection followed by dangerous commands
+        (;|&&|\|\|)\s*(?:sudo\s+)?(?:curl\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.0\.0\.1|0\.0\.0\.0)|wget\s+(?:-\S+\s+)*['"]?https?://(?!localhost|127\.)|\bnc\b\s+-?[a-z0-9]|ncat\s+\S|\b(?:ba)?sh\s+-[ic]|python[0-9]?\s+-c|perl\s+-e|ruby\s+-e|node\s+-e|\beval\s|rm\s+-[rf]|cat\s+/etc/(?:passwd|shadow|sudoers)|whoami|\bid\b\s*(?:;|&|\||$)|uname\s+-a|base64\s+(?:-d|--decode)|ifconfig|>&\s*/dev/tcp)|[$`]\([^)`]{0,80}(?:curl|wget|\bnc\b|\bbash\b|\bsh\s+-|whoami|\bid\b|base64\s+-d|/etc/(?:passwd|shadow))
+      description: Shell metacharacter chained to a genuinely dangerous command — external network fetch, pipe-to-shell / interpreter one-liner, recon (whoami/id/uname -a), or sensitive-file read (v2 tightened; legit build chains like "npm i && bash setup.sh", "&& python -m pytest", "| jq" no longer fire)
     - field: tool_name
       operator: regex
       value: (?i)^(admin_|root_|sudo_|system_|internal_|debug_|maintenance_|privileged_|superuser_|__)

package/rules/tool-poisoning/ATR-2026-00161-important-tag-cross-tool-shadowing.yaml

@@ -1,6 +1,6 @@
 title: "MCP Tool Description — IMPORTANT Tag Cross-Tool Shadowing Attack"
 id: ATR-2026-00161
-rule_version: 1
+rule_version: 2
 status: experimental
 description: >
   Detects MCP tool poisoning attacks that embed hidden instructions inside an
@@ -33,6 +33,7 @@ references:
     - "AML.T0051.001 - Indirect"
     - "AML.T0053 - AI Agent Tool Invocation"
     - "AML.T0110 - AI Agent Tool Poisoning"
+    - "AML.T0104 - Publish Poisoned AI Agent Tool"
   safe_mcp:
     - "SAFE-T1102 - Prompt Manipulation"
     - "SAFE-T1001 - Tool Poisoning"
@@ -124,8 +125,8 @@ detection:
     # variants like $HOME/.ssh/id_rsa, ~/.ssh/id_rsa, /root/.ssh/id_rsa.
     - field: content
       operator: regex
-      value: '\b(?:id_rsa|id_dsa|id_ed25519|id_ecdsa|mcp\.json|\.aws/credentials|\.aws/config|\.kube/config|\.docker/config\.json|\.netrc|known_hosts)\b|/etc/(?:passwd|shadow|ssl/private)|/proc/self/environ|\b\.env(?:\.local|\.production|\.secret)?\b(?![/a-zA-Z])'
-      description: "Sensitive credential file referenced in tool description — tool signatures should not need to read private keys or cloud credentials"
+      value: '\b(?:id_rsa|id_dsa|id_ed25519|id_ecdsa)\b(?!\.pub)|\b(?:\.aws/credentials|\.kube/config|\.docker/config\.json|\.netrc|known_hosts)\b|/etc/(?:passwd|shadow|ssl/private)|/proc/self/environ|\b\.env(?:\.local|\.production|\.secret)?\b(?![/a-zA-Z])'
+      description: "Sensitive credential file referenced in tool description — private keys or cloud credentials (v2: dropped mcp.json + .aws/config — common non-secret config files that appear in ordinary git/edit operations; the exfil case is still caught by the <IMPORTANT>-tag and read/send-directive layers. id_rsa excludes the .pub public key.)"
 
     # Layer 4 — Concealment directive combined with "implementation detail"
     # justification. This is the exact pattern Invariant Labs documented for

package/rules/tool-poisoning/ATR-2026-00581-mcp-tool-rug-pull-post-approval-redefinition.yaml

@@ -29,6 +29,7 @@ references:
   mitre_atlas:
   - "AML.T0053 - AI Agent Tool Invocation"
   - "AML.T0051.001 - Indirect"
+  - "AML.T0104 - Publish Poisoned AI Agent Tool"
   vulnerablemcp_id:
     - tool-poisoning-rce-rug-pull
   external:

package/rules/tool-poisoning/ATR-2026-01932-shadow-undeclared-mcp-server-registration.yaml

@@ -29,6 +29,7 @@ references:
     - "ASI09:2026 - Identity Spoofing and Impersonation"
   mitre_atlas:
     - "AML.T0010 - AI Supply Chain Compromise"
+    - "AML.T0104 - Publish Poisoned AI Agent Tool"
   mitre_attack:
     - "T1195.002 - Compromise Software Supply Chain"
     - "T1036 - Masquerading"