agent-threat-rules 4.0.0 → 4.1.5

package/rules/tool-poisoning/ATR-2026-02682-xml-entity-expansion-bomb.yaml

@@ -0,0 +1,98 @@
+title: XML/SVG Entity Expansion Bomb in Content Returned to an Agent
+id: ATR-2026-02682
+rule_version: 2
+status: experimental
+description: |
+  Detects an entity-expansion bomb (billion laughs / quadratic blowup) inside XML, SVG, SBOM, XLSX-sheet or DTD content that a tool returns to an agent, or that an agent writes out. The decisive text is a DTD entity whose replacement value is a packed run of six or more entity references -- <!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;&a;&a;"> -- which is the only reason to write such a value: each layer multiplies, so a few hundred bytes expand to gigabytes and the parser, not the network, is what fails. Mined from CVE-2026-25128 (fast-xml-parser numeric-entity RangeError DoS). ATR already covers the OTHER half of the DTD attack surface -- external entities pulling file:// or http:// URLs (ATR-2026-00568 / ATR-2026-01608) -- because those rules key on a URI scheme. An expansion bomb contains no URI at all, so nothing in the corpus sees it. Benign DTDs are deliberately excluded: an entity table (<!ENTITY copyright "&#169; 2026 Example Ltd">) and a composite entity built from a handful of separated references (<!ENTITY footer "&company; &address; &phone;">) both fail the pattern, which requires SIX OR MORE references with no separator between them.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: medium
+references:
+  cve:
+    - CVE-2026-25128
+  cwe:
+    - CWE-776
+    - CWE-400
+  owasp_llm:
+    - LLM10:2025
+    - LLM05:2025
+  owasp_agentic:
+    - ASI06:2026
+    - ASI03:2026
+  mitre_attack:
+    - T1499.004 - Application or System Exploitation
+  mitre_atlas:
+    - AML.T0029 - Denial of ML Service
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-25128
+    - https://cwe.mitre.org/data/definitions/776.html
+metadata_provenance:
+  cve: human-reviewed
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires AI systems to be resilient against attempts to exploit vulnerabilities; this rule detects a parser resource-exhaustion payload arriving through tool output.
+      strength: primary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be treated; availability loss through untrusted-document parsing is treated here at runtime.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Denial of service through untrusted document ingestion is an identified AI risk requiring an active runtime countermeasure; this rule implements it.
+      strength: primary
+    - subcategory: MS.2.6
+      context: Measuring AI system resilience and safety under adversarial input; this rule instruments the resource-exhaustion case.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by screening ingested documents for expansion bombs before they reach a parser.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented by alerting on the bomb's entity-chain signature.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: xml-entity-expansion-bomb
+  scan_target: agent
+  confidence: high
+  suppress_in_code_blocks: true
+agent_source:
+  type: mcp_exchange
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: content
+      operator: regex
+      value: (?i)<!entity\s+(?:%\s*)?[\w.-]{1,24}\s+["'][^"']{0,200}["']\s*>[\s\S]{0,200}<!entity\s+(?:%\s*)?[\w.-]{1,24}\s+["'](?:[&%][\w.-]{1,12};){6,}
+      description: 'An entity declaration with a real body, followed within 200 characters by an entity whose value is a packed run of six or more references -- the two-layer structure a billion-laughs bomb needs. The chain is required because a single declaration cannot multiply: it expands once and stops.'
+    - field: content
+      operator: regex
+      value: (?i)<!entity\s+(?:%\s*)?[\w.-]{1,24}\s+["'](?:[&%][\w.-]{1,12};){6,}[\s\S]{0,200}<!entity\s+(?:%\s*)?[\w.-]{1,24}\s+["'](?:[^&"'\r\n]|&[^#"'\r\n])
+      description: The same two layers in the reverse declaration order, with the companion entity required to have a real body rather than a bare character reference (which is what a spacing or punctuation entity points at).
+  false_positives:
+    - 'FIXED in rule_version 2 -- A PACKED RUN OF CHARACTER ENTITIES IS NOT A BOMB. The pattern keyed on the run alone, so it fired on the ordinary publishing idiom of defining a fixed amount of space or punctuation: <!ENTITY sp6 "&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;">, an em-dash rule, a table-of-contents leader of &hellip;, an &emsp; gutter, and a DTD content model concatenating six short parameter entities. None of these can multiply -- they reference a character entity, expand exactly once and stop, which is the opposite of the property this rule exists to detect. The rule now requires the TWO-LAYER CHAIN a bomb needs: a companion entity declaration with a real body, either before the packed run or after it. Four measured FPs plus one DTD case are silent; all three true positives are unaffected.'
+    - 'FIXED in rule_version 2 -- the same chain requirement removed the entire quotation class. Security writing quotes the ONE decisive line (<!ENTITY lol2 "&lol;&lol;...">) because that line is the explanation; it does not carry the companion declaration that makes the line dangerous. Measured: an unfenced CVE-2026-25128 write-up, the same write-up in Traditional Chinese, a hardening CHANGELOG and a fuzzer log line all fired before and are silent after. This was previously documented as a KNOWN RESIDUAL that suppress_in_code_blocks could only half-cover; it is now genuinely fixed rather than suppressed.'
+    - 'RESIDUAL, MEASURED AND IRREDUCIBLE: a parser''s own regression fixture -- tests/fixtures/billion_laughs.xml, checked in so the test can assert the parser REFUSES it -- still fires. The file is a complete, working bomb; it is benign only because of where it lives, and no pattern over its bytes can know that.'
+    - 'EVASION, STATED PLAINLY: the chain requirement gives a 200-character proximity window between the two declarations. A bomb that pads the gap wider than that, or that splits its layers across two documents, is no longer detected. Both declaration orders are covered, so simply reordering them does not evade.'
+    - An ordinary entity table such as <!ENTITY copyright "&#169; 2026 Example Ltd"> or <!ENTITY amp "&#38;"> -- a single reference, not a packed run
+    - A composite entity built from separated references, e.g. <!ENTITY footer "&company; &address; &phone;"> -- the spaces break the run and the count is below six
+    - XHTML/DocBook DTD driver files that declare and immediately invoke parameter entities (%HTMLlat1;) -- each declaration holds a public identifier, not a reference run
+    - 'A security article or advisory that prints the billion-laughs payload: the rule sets suppress_in_code_blocks, so a payload inside a markdown fence or inline backticks is not reported. KNOWN RESIDUAL: an article that pastes the payload as bare prose, with no fence and no backticks, will still match -- and so would a poisoned document, which is the reason the suppression is limited to code context rather than removed.'
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02682] Ingested XML/SVG/DTD content declares an entity whose value is a packed run of entity references -- an expansion bomb. Do not hand this document to an XML parser; expansion is multiplicative and will exhaust memory before any content is produced.
+confidence: 82

package/rules/tool-poisoning/ATR-2026-02707-crlf-header-injection-mail-tool-argument.yaml

@@ -0,0 +1,88 @@
+title: Mail or Attachment Tool Argument Splits into a New Header via Embedded CRLF
+id: ATR-2026-02707
+rule_version: 2
+status: experimental
+description: |
+  Detects a recipient, subject or filename argument of an agent mail/attachment tool whose QUOTED value contains a line break followed by a fresh RFC 5322 / MIME header name or an SMTP verb -- `to: "user@corp.example\r\nBcc: watcher@collector.example"`, `filename: "report.pdf\r\nContent-Type: text/html"`, `\r\nRCPT TO:`. Mined from CVE-2026-30227 (MimeKit CRLF injection in a quoted local-part enabling SMTP command injection and sender forgery); the same one-value-becomes-two-lines shape is what CVE-2026-43882 exploits in ICS and what header smuggling exploits in HTTP. Verified on the shipped engine that `{"tool":"send_email","to":"user\r\nBcc: watcher@..."}` matched only ATR-2026-00063/00099, and that a BENIGN control (`to: alice@corp.example, subject: Q3`) matched the same rules -- i.e. those hits are spray, not coverage of CRLF at all. The opening quote is required deliberately: without it the condition fires on every raw RFC822 header block (`From: alice@corp.example` newline `To: ...`), which is ordinary mailbox content and was the first false positive this rule produced during authoring.
+author: ATR Community (CVE sweep)
+date: 2026/08/23
+schema_version: '0.1'
+detection_tier: pattern
+maturity: test
+severity: high
+references:
+  cwe:
+    - CWE-93
+    - CWE-77
+  owasp_llm:
+    - LLM05:2025
+  owasp_agentic:
+    - ASI04:2026
+  mitre_attack:
+    - T1114 - Email Collection
+  mitre_atlas:
+    - AML.T0053 - LLM Plugin Compromise
+  cve:
+    - CVE-2026-30227
+  external:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-30227
+metadata_provenance:
+  cwe: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
+  mitre_attack: human-reviewed
+  mitre_atlas: human-reviewed
+compliance:
+  eu_ai_act:
+    - article: '15'
+      context: Article 15 (accuracy, robustness and cybersecurity) requires resilience against inputs that alter system behaviour; this rule detects a mail-tool argument that splits into an additional header, silently adding a recipient or changing the MIME type.
+      strength: primary
+    - article: '9'
+      context: Article 9 (risk management system) requires identified risks to be treated; this rule is the runtime treatment for CRLF header injection through agent mail tools.
+      strength: secondary
+  nist_ai_rmf:
+    - subcategory: MG.2.3
+      context: Silent recipient injection through an agent mail tool is an identified AI risk requiring an active runtime countermeasure; this rule implements it.
+      strength: primary
+    - subcategory: MP.5.1
+      context: Cataloguing CRLF-driven header splitting in tool arguments as an AI-specific risk in the organizational risk register.
+      strength: secondary
+  iso_42001:
+    - clause: '8.1'
+      context: ISO/IEC 42001 Clause 8.1 (operational planning and control) is operationalised by rejecting line breaks in single-line tool arguments before the message is submitted.
+      strength: primary
+    - clause: '8.3'
+      context: ISO/IEC 42001 Clause 8.3 (AI risk treatment) is implemented through runtime detection of the header split.
+      strength: secondary
+tags:
+  category: tool-poisoning
+  subcategory: crlf-header-injection-tool-argument
+  scan_target: runtime
+  confidence: high
+agent_source:
+  type: tool_call
+  framework:
+    - any
+  provider:
+    - any
+detection:
+  condition: any
+  conditions:
+    - field: tool_args
+      operator: regex
+      value: '["\x27](?:to|cc|bcc|from|reply[_-]?to|subject|filename|attachment)["\x27]\s{0,3}[:=]\s{0,3}["\x27][^"\x27\r\n]{0,40}(?:\\r)?(?:\\n|[\r\n])\s{0,4}(?:bcc|cc|reply-to|content-type|content-transfer-encoding|content-disposition|mime-version|rcpt\s{1,3}to|mail\s{1,3}from|x-[a-z][a-z0-9-]{1,20})\s{0,2}:'
+      description: 'A recipient/subject/filename argument whose QUOTED KEY and QUOTED VALUE come from a serialized tool call, and whose value contains a line break followed by a new mail header name or SMTP verb. rule_version 2 made the KEY quote mandatory as well as the value quote. Version 1 required only the value quote, and that let every piece of writing ABOUT this attack through: an advisory saying to="user@corp.example\r\nBcc: ...", a library changelog, a WAF signature note, an OWASP-style cheat sheet, a pentest finding and a non-English advisory all fired, because documentation writes the argument assignment exactly the way the attack does -- with an unquoted key. Every one of this rule''s own true positives and its evasion test uses the quoted-key form, so recall is unchanged.'
+  false_positives:
+    - 'ADVERSARIAL, 2026-08-24 refutation pass: rule_version 1 fired on 6 of 14 benign probes, ALL of them security writing that quotes the payload with its argument assignment -- the CVE-2026-30227 advisory, a library changelog, a WAF signature note, an OWASP-style explanation, a pentest finding, and a Traditional Chinese advisory. Version 1''s false-positive list claimed documentation normally quotes the payload WITHOUT an argument assignment; that claim was wrong. Fixed by requiring the argument key to be quote-delimited, which prose is not. All six are now true_negatives.'
+    - 'RESIDUAL, accepted: an article or eval dataset that reproduces the verbatim serialized call still matches -- same bytes as the attack.'
+    - 'RESIDUAL, ambiguous by design: a mail parser that joins repeated headers of the same name into one value ({"cc":"a@corp.example\r\nCc: c@corp.example"}) matches. This is NOT excluded on purpose: a value that adds a second Cc recipient is the attack whether a parser or an attacker produced it, and RE2 has no backreference with which to require that the injected header name differ from the argument name.'
+    - 'A raw RFC822 message or mailbox export, where From:/To:/Subject: lines follow one another unquoted. The condition requires an opening quote immediately before the value, which unquoted header blocks do not have -- this was the first measured false positive during authoring and the reason the quote is mandatory.'
+    - A parsed email object ({"from":"alice@corp.example","to":"bob@corp.example"}), because each value is closed before the next field and no line break sits inside a value.
+    - A multi-line message BODY, since body/text/html/content are not in the argument-name set.
+    - Documentation describing CRLF injection, which normally quotes the payload without a preceding argument assignment inside quotes.
+response:
+  actions:
+    - alert
+  message_template: |
+    [ATR-2026-02707] A mail or attachment tool argument contains a line break followed by a new header name -- one value is becoming two headers. Reject CR and LF in single-line address, subject and filename parameters.
+confidence: 80

package/spec/README.md

@@ -282,6 +282,6 @@ OASIS Open Project."
 - Spec issues: GitHub Issues with label `spec-bug` or `spec-question`
 - Spec proposals: GitHub Pull Requests with AEP template
 - Maintainer: Adam Lin <adam@agentthreatrule.org>
-- Fiscal sponsor: Open Source Collective Inc. (501(c)(3),
-  EIN 81-1567737)
+- Fiscal sponsor: Open Source Collective Inc. (501(c)(6),
+  EIN 82-2037583)
 - TSC (post-ratification): tsc@agentthreatrule.org (mailing list, public)

package/spec/atr-correlation-v1.0.md

@@ -71,13 +71,13 @@ correlation:
 
 source_rules:
   - alias: "injection"
-    rule_id: "ATR-2026-00012"                 # indirect prompt injection
+    rule_id: "ATR-2026-00002"                 # indirect prompt injection
   - alias: "tool_call"
-    rule_id_pattern: "ATR-2026-001*"          # tool-poisoning class
+    rule_id: "ATR-2026-00012"                 # unauthorized tool call (tool-poisoning)
   - alias: "memory_write"
-    rule_id_pattern: "ATR-2026-003*"          # memory write
+    rule_id: "ATR-2026-00075"                 # agent memory manipulation
   - alias: "exfil"
-    rule_id_pattern: "ATR-2026-006*"          # context exfiltration
+    rule_id: "ATR-2026-00020"                 # system prompt leak (context exfiltration)
 
 correlation_logic:
   type: "temporal_sequence"                   # see § Correlation types below
@@ -105,6 +105,18 @@ response:
     Recommend immediate session quarantine plus memory store audit.
 ```
 
+> **Note on `rule_id_pattern` (added 2026-09-22).** ATR rule IDs are allocated
+> sequentially in a single five-digit space (`ATR-2026-00001` .. `ATR-2026-02845`
+> as of 2026-09-22); the digits do **not** encode a threat category. An
+> ID-prefix glob is therefore not a way to select "all rules in category X" —
+> it selects a numeric band that spans several categories and that shifts as
+> new rules are allocated. Earlier revisions of this example used band globs
+> such as `ATR-2026-006*` with category comments; under the current ID space
+> those patterns match either nothing or an unrelated set of rules. Prefer
+> explicit `rule_id` values, as the example above now does, and treat
+> `rule_id_pattern` as a convenience for genuinely contiguous, deliberately
+> allocated ranges only.
+
 ---
 
 ## Correlation types

package/spec/atr-profile-v1.0.md

@@ -244,9 +244,19 @@ inclusions:
       severity: ["critical", "high", "medium"]
 
 exclusions:
-  - rule_id_pattern: "ATR-2026-009*"          # de-scoped per BSI editorial
+  - rule_id_pattern: "ATR-2026-009*"          # illustrative glob, not a live ID band
 ```
 
+> **Note on `rule_id_pattern` (added 2026-09-22).** The ID globs in the
+> examples above are illustrative syntax, not live selectors. ATR rule IDs are
+> allocated sequentially in one five-digit space and do **not** encode a threat
+> category, so an ID-prefix glob selects a numeric band that spans categories
+> and that shifts as new rules are allocated. To select by category, use
+> `tag_match.category` as shown above. Reserve `rule_id_pattern` for genuinely
+> contiguous, deliberately allocated ranges, and pin the corpus version any
+> profile was resolved against.
+
+
 The `profile: "<other-profile>@<version>"` inclusion syntax enables
 composition — a sovereign profile inherits baseline + adds its
 sovereign-specific rules + de-scopes any rules its authority does