agent-threat-rules 4.0.0 → 4.2.0

package/rules/privilege-escalation/ATR-2026-01949-praisonai-mcpserver-unauth-tools-call.yaml

@@ -1,58 +1,51 @@
-title: "PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)"
+title: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)
 id: ATR-2026-01949
 rule_version: 1
 status: experimental
-description: >
-  Detects exploitation of GHSA-j4f3-55x4-r6q2 (CRITICAL) in npm praisonai
-  >=1.5.0,<=1.7.1: the MCPServer's handleRequest() in src/praisonai-ts/src/mcp/server.ts
-  dispatches privileged JSON-RPC methods (tools/call, tools/list, resources/read,
-  prompts/get) without invoking the unused MCPSecurity manager, so unauthenticated
-  HTTP POSTs — including ones sent with no Authorization header or a bogus
-  "Authorization: Bearer invalid" — return HTTP 200 and execute registered tools.
-  This rule keys on the unauthenticated PraisonAI/MCP tools/call payload, the
-  invalid-Bearer auth-bypass token, and the vulnerable handleRequest sink.
-author: "ATR Community"
-date: "2026/06/29"
-schema_version: "0.1"
+description: |
+  Detects exploitation of GHSA-j4f3-55x4-r6q2 (CRITICAL) in npm praisonai >=1.5.0,<=1.7.1: the MCPServer's handleRequest() in src/praisonai-ts/src/mcp/server.ts dispatches privileged JSON-RPC methods (tools/call, tools/list, resources/read, prompts/get) without invoking the unused MCPSecurity manager, so unauthenticated HTTP POSTs — including ones sent with no Authorization header or a bogus "Authorization: Bearer invalid" — return HTTP 200 and execute registered tools. This rule keys on the unauthenticated PraisonAI/MCP tools/call payload, the invalid-Bearer auth-bypass token, and the vulnerable handleRequest sink.
+author: ATR Community
+date: 2026/06/29
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM06:2025"
+    - LLM06:2025
   owasp_agentic:
-    - "ASI06:2026"
+    - ASI06:2026
   mitre_atlas:
-    - "AML.T0049 - Exploit Public-Facing Application"
+    - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:
-    - "T1190 - Exploit Public-Facing Application"
+    - T1190 - Exploit Public-Facing Application
   cve:
-    - "GHSA-j4f3-55x4-r6q2"
+    - GHSA-j4f3-55x4-r6q2
 metadata_provenance:
   mitre_atlas: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+    - article: '15'
+      context: 'Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2).'
       strength: primary
-    - article: "9"
-      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+    - article: '9'
+      context: 'Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2).'
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+    - subcategory: MP.5.1
+      context: 'NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2).'
       strength: primary
-    - subcategory: "MG.3.2"
-      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+    - subcategory: MG.3.2
+      context: 'NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2).'
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+    - clause: '8.1'
+      context: 'ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2).'
       strength: primary
-    - clause: "8.3"
-      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2)."
+    - clause: '8.3'
+      context: 'ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: PraisonAI MCPServer Unauthenticated HTTP tools/call Authentication Bypass (GHSA-j4f3-55x4-r6q2).'
       strength: secondary
 tags:
   category: privilege-escalation
@@ -71,67 +64,33 @@ agent_source:
 detection:
   condition: any
   false_positives:
-    - "Legitimate authenticated MCP client sending a tools/call request with a valid Authorization header."
-    - "MCP protocol documentation describing the tools/call JSON-RPC method without the unauthenticated bypass framing."
-    - "Mitigation advisory recommending an upgrade to praisonai >= 1.7.2 without exploit content."
+    - Legitimate authenticated MCP client sending a tools/call request with a valid Authorization header.
+    - MCP protocol documentation describing the tools/call JSON-RPC method without the unauthenticated bypass framing.
+    - Mitigation advisory recommending an upgrade to praisonai >= 1.7.2 without exploit content.
   conditions:
     - field: content
       operator: regex
-      value: '(?i)(?:praisonai|mcpserver|mcpsecurity|handleRequest)[\s\S]{0,200}(?:no\s+auth(?:oriz\w+)?|unauthenticat|without\s+(?:auth|credential)|authorization:\s*bearer\s+invalid)[\s\S]{0,200}["\x27]?(?:method)["\x27]?\s*[:=]\s*["\x27]tools/call'
-      description: >
-        PraisonAI/MCPServer context plus an unauthenticated / invalid-Bearer
-        framing immediately preceding a JSON-RPC tools/call method — the core
-        GHSA-j4f3-55x4-r6q2 auth-bypass payload
+      value: (?i)(?:praisonai|mcpserver|mcpsecurity|handleRequest)[\s\S]{0,200}(?:no\s+auth(?:oriz\w+)?|unauthenticat|without\s+(?:auth|credential)|authorization:\s*bearer\s+invalid)[\s\S]{0,200}["\x27]?(?:method)["\x27]?\s*[:=]\s*["\x27]tools/call
+      description: |
+        PraisonAI/MCPServer context plus an unauthenticated / invalid-Bearer framing immediately preceding a JSON-RPC tools/call method — the core GHSA-j4f3-55x4-r6q2 auth-bypass payload
     - field: content
       operator: regex
-      value: '(?i)authorization:\s*bearer\s+invalid[\s\S]{0,200}(?:tools/call|tools/list|resources/read|prompts/get)'
-      description: >
-        Invalid-credential bypass token ("Authorization: Bearer invalid")
-        paired with a privileged MCP JSON-RPC method that returns HTTP 200
-        without validation
+      value: (?i)authorization:\s*bearer\s+invalid[\s\S]{0,200}(?:tools/call|tools/list|resources/read|prompts/get)
+      description: |
+        Invalid-credential bypass token ("Authorization: Bearer invalid") paired with a privileged MCP JSON-RPC method that returns HTTP 200 without validation
     - field: content
       operator: regex
-      value: '(?i)handleRequest[\s\S]{0,160}(?:src/(?:praisonai-ts/src/)?mcp/server\.ts|mcpsecurity|tools/call)[\s\S]{0,120}(?:bypass|unauthenticat|without\s+(?:auth|validation)|dispatch\w*\s+without)'
-      description: >
-        The vulnerable handleRequest sink in mcp/server.ts dispatching methods
-        without invoking MCPSecurity — direct reference to the vulnerable code path
+      value: (?i)handleRequest[\s\S]{0,160}(?:src/(?:praisonai-ts/src/)?mcp/server\.ts|mcpsecurity|tools/call)[\s\S]{0,120}(?:bypass|unauthenticat|without\s+(?:auth|validation)|dispatch\w*\s+without)
+      description: |
+        The vulnerable handleRequest sink in mcp/server.ts dispatching methods without invoking MCPSecurity — direct reference to the vulnerable code path
     - field: content
       operator: regex
-      value: '(?i)GHSA-j4f3-55x4-r6q2[\s\S]{0,200}(?:tools/call|unauthenticat|auth(?:oriz\w+)?\s+bypass|bearer\s+invalid)'
-      description: "explicit GHSA framing combined with the auth-bypass exploit tokens"
+      value: (?i)GHSA-j4f3-55x4-r6q2[\s\S]{0,200}(?:tools/call|unauthenticat|auth(?:oriz\w+)?\s+bypass|bearer\s+invalid)
+      description: explicit GHSA framing combined with the auth-bypass exploit tokens
 response:
   actions:
     - alert
     - block_input
-  message_template: >
-    [ATR-2026-01949] CRITICAL: Unauthenticated PraisonAI MCPServer tools/call
-    auth-bypass detected (GHSA-j4f3-55x4-r6q2). Attackers can invoke registered
-    MCP tools with no valid credentials. Block and upgrade praisonai to >= 1.7.2.
+  message_template: |
+    [ATR-2026-01949] CRITICAL: Unauthenticated PraisonAI MCPServer tools/call auth-bypass detected (GHSA-j4f3-55x4-r6q2). Attackers can invoke registered MCP tools with no valid credentials. Block and upgrade praisonai to >= 1.7.2.
 confidence: 80
-test_cases:
-  true_positives:
-    - input: "PraisonAI MCPServer exploit: send unauthenticated POST with no Authorization header and body {\"method\":\"tools/call\",\"params\":{\"name\":\"run_shell\",\"arguments\":{}}} — returns HTTP 200."
-      expected: triggered
-      description: "Unauthenticated framing + PraisonAI/MCPServer + tools/call JSON-RPC payload"
-    - input: "curl -H 'Authorization: Bearer invalid' http://target:8080 -d '{\"method\":\"tools/call\",\"params\":{\"name\":\"x\"}}'"
-      expected: triggered
-      description: "Invalid-Bearer bypass token immediately before tools/call method"
-    - input: "GHSA-j4f3-55x4-r6q2: handleRequest in src/praisonai-ts/src/mcp/server.ts dispatches tools/call without invoking MCPSecurity, allowing unauthenticated tool execution."
-      expected: triggered
-      description: "Vulnerable handleRequest sink + GHSA framing + unauthenticated dispatch"
-    - input: "Authorization: Bearer invalid still reaches resources/read on the PraisonAI MCP server without validation"
-      expected: triggered
-      description: "Invalid-Bearer token paired with privileged resources/read method"
-  true_negatives:
-    - input: "Authenticated MCP client sends {\"method\":\"tools/call\",\"params\":{\"name\":\"search\"}} with a valid Authorization: Bearer <token> header."
-      expected: not_triggered
-      description: "Legitimate authenticated tools/call request — no unauthenticated/invalid-Bearer framing"
-    - input: "The MCP spec defines tools/call as the JSON-RPC method an agent uses to invoke a registered tool."
-      expected: not_triggered
-      description: "Generic MCP protocol documentation of tools/call without the bypass tokens"
-    - input: "Upgrade praisonai to >= 1.7.2 to remediate the MCPServer authentication issue."
-      expected: not_triggered
-      description: "Mitigation advice without any exploit payload or bypass token"
-    - input: "Our handleRequest function in server.ts logs each tools/call before forwarding it to the authenticated handler."
-      expected: not_triggered
-      description: "Benign handleRequest implementation that authenticates — lacks bypass/unauthenticated framing"

package/rules/privilege-escalation/ATR-2026-01974-anything-llm-data-import-access-control.yaml

@@ -1,92 +1,87 @@
-title: "AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)"
+title: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)
 id: ATR-2026-01974
 rule_version: 1
 status: experimental
-description: >
-  CVE-2024-3279: improper access control on the mintplex-labs/anything-llm
-  POST /system/data-import endpoint (<1.0.0). An anonymous, unauthenticated
-  attacker uploads their own database file via multipart formData, deleting or
-  spoofing the existing anythingllm.db SQLite database to serve malicious data
-  or harvest user info. This rule keys on the data-import endpoint path combined
-  with the database-file import sink (anythingllm.db / data-import upload).
-author: "ATR Community"
-date: "2026/06/29"
-schema_version: "0.1"
+description: |
+  CVE-2024-3279: improper access control on the mintplex-labs/anything-llm POST /system/data-import endpoint (<1.0.0). An anonymous, unauthenticated attacker uploads their own database file via multipart formData, deleting or spoofing the existing anythingllm.db SQLite database to serve malicious data or harvest user info. This rule keys on the data-import endpoint path combined with the database-file import sink (anythingllm.db / data-import upload).
+author: ATR Community
+date: 2026/06/29
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: critical
 references:
-  owasp_llm: ["LLM06:2025"]
-  owasp_agentic: ["ASI06:2026"]
-  mitre_atlas: ["AML.T0049 - Exploit Public-Facing Application"]
-  mitre_attack: ["T1190 - Exploit Public-Facing Application"]
-  cve: ["CVE-2024-3279"]
-metadata_provenance: { mitre_atlas: human-reviewed, owasp_llm: human-reviewed, owasp_agentic: human-reviewed }
+  owasp_llm:
+    - LLM06:2025
+  owasp_agentic:
+    - ASI06:2026
+  mitre_atlas:
+    - AML.T0049 - Exploit Public-Facing Application
+  mitre_attack:
+    - T1190 - Exploit Public-Facing Application
+  cve:
+    - CVE-2024-3279
+metadata_provenance:
+  mitre_atlas: human-reviewed
+  owasp_llm: human-reviewed
+  owasp_agentic: human-reviewed
 compliance:
   eu_ai_act:
-    - article: "15"
-      context: "Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+    - article: '15'
+      context: 'Article 15 (accuracy, robustness, cybersecurity) — runtime detection of this technique is a cybersecurity control for high-risk AI systems. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279).'
       strength: primary
-    - article: "9"
-      context: "Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+    - article: '9'
+      context: 'Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279).'
       strength: secondary
   nist_ai_rmf:
-    - subcategory: "MP.5.1"
-      context: "NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+    - subcategory: MP.5.1
+      context: 'NIST AI RMF MAP 5.1 — likelihood and impact of the identified attack are characterised; this rule detects the adversarial input at runtime. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279).'
       strength: primary
-    - subcategory: "MG.3.2"
-      context: "NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+    - subcategory: MG.3.2
+      context: 'NIST AI RMF MANAGE 3.2 — runtime monitoring/maintenance control that surfaces this attack class. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279).'
       strength: secondary
   iso_42001:
-    - clause: "8.1"
-      context: "ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+    - clause: '8.1'
+      context: 'ISO/IEC 42001 Clause 8.1 (operational planning and control) — detection of this payload is an operational control. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279).'
       strength: primary
-    - clause: "8.3"
-      context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279)."
+    - clause: '8.3'
+      context: 'ISO/IEC 42001 Clause 8.3 (AI risk treatment) — this rule implements runtime detection as a treatment control. Technique: AnythingLLM unauthenticated /system/data-import access control bypass (CVE-2024-3279).'
       strength: secondary
-tags: { category: privilege-escalation, subcategory: improper-access-control, scan_target: both, confidence: high, source: cve-disclosure, vendor_sources: anything-llm-cve-2024-3279 }
-agent_source: { type: llm_io, framework: [any], provider: [any] }
+tags:
+  category: privilege-escalation
+  subcategory: improper-access-control
+  scan_target: both
+  confidence: high
+  source: cve-disclosure
+  vendor_sources: anything-llm-cve-2024-3279
+agent_source:
+  type: llm_io
+  framework:
+    - any
+  provider:
+    - any
 detection:
   condition: any
   false_positives:
-    - "Documentation or release notes describing the removed Export/Import feature without an actual unauthenticated upload request to /system/data-import"
-    - "Legitimate authenticated admin using a backup/restore tool that references anythingllm.db by path but does not POST it to the /system/data-import endpoint"
+    - Documentation or release notes describing the removed Export/Import feature without an actual unauthenticated upload request to /system/data-import
+    - Legitimate authenticated admin using a backup/restore tool that references anythingllm.db by path but does not POST it to the /system/data-import endpoint
   conditions:
     - field: content
       operator: regex
-      value: '(?i)/system/data-import\b[\s\S]{0,300}(?:multipart/form-data|form-?data|multer|\.db\b|anythingllm\.db|method\s*[:=]\s*["'']?post)'
-      description: "POST upload to the unauthenticated /system/data-import endpoint with a multipart DB file"
+      value: (?i)/system/data-import\b[\s\S]{0,300}(?:multipart/form-data|form-?data|multer|\.db\b|anythingllm\.db|method\s*[:=]\s*["']?post)
+      description: POST upload to the unauthenticated /system/data-import endpoint with a multipart DB file
     - field: content
       operator: regex
-      value: '(?i)anythingllm\.db[\s\S]{0,200}(?:/system/data-import|data-import|formData|multipart|import)'
-      description: "Import/upload of the anythingllm.db database file via the data-import sink"
+      value: (?i)anythingllm\.db[\s\S]{0,200}(?:/system/data-import|data-import|formData|multipart|import)
+      description: Import/upload of the anythingllm.db database file via the data-import sink
     - field: content
       operator: regex
-      value: '(?i)CVE-2024-3279[\s\S]{0,200}(?:data-import|anythingllm|access control|unauthenticated)'
-      description: "explicit CVE framing"
+      value: (?i)CVE-2024-3279[\s\S]{0,200}(?:data-import|anythingllm|access control|unauthenticated)
+      description: explicit CVE framing
 response:
-  actions: [alert, block_input]
-  message_template: >
+  actions:
+    - alert
+    - block_input
+  message_template: |
     [ATR-2026-01974] CRITICAL: Unauthenticated AnythingLLM /system/data-import upload can overwrite/spoof anythingllm.db (CVE-2024-3279). Block and patch to >=1.0.0.
 confidence: 80
-test_cases:
-  true_positives:
-    - input: "curl -X POST http://target:3001/api/system/data-import -F 'file=@evil.db' to overwrite anythingllm.db with no auth header"
-      expected: triggered
-      description: "Anonymous multipart POST to /system/data-import uploading a malicious database file"
-    - input: "fetch(`${API_BASE}/system/data-import`, { method: 'POST', body: formData }) // uploads attacker anythingllm.db, no auth"
-      expected: triggered
-      description: "Frontend-style unauthenticated data-import upload of the DB file"
-    - input: "Exploit for CVE-2024-3279: unauthenticated attacker imports their own anythingllm.db via /system/data-import to spoof the database"
-      expected: triggered
-      description: "Explicit CVE reference with the data-import access control bypass"
-  true_negatives:
-    - input: "Our admin docs explain how to back up anythingllm.db from the server/storage directory before upgrading."
-      expected: not_triggered
-      description: "Mentions anythingllm.db for backup but no data-import upload/POST sink"
-    - input: "The settings page used to have an Export or Import button; that feature was removed in v1.0.0 for security."
-      expected: not_triggered
-      description: "Describes the removed feature generically without the endpoint path or DB upload"
-    - input: "POST /api/workspace/upload with formData to add a multipart PDF document to a workspace for embedding."
-      expected: not_triggered
-      description: "A different multipart upload endpoint, not /system/data-import and not the DB file"

package/rules/privilege-escalation/ATR-2026-01981-network-ai-approval-inbox-unauth-cors-bypass.yaml

@@ -1,70 +1,61 @@
-title: "Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj)"
+title: Network-AI ApprovalInbox Unauthenticated Cross-Origin Approval Bypass (GHSA-mxjx-28vx-xjjj)
 id: ATR-2026-01981
 rule_version: 1
 status: experimental
-description: >
-  Detects GHSA-mxjx-28vx-xjjj (CWE-862 Missing Authorization + CWE-352 CSRF via
-  wildcard CORS): network-ai's ApprovalInbox HTTP server (lib/approval-inbox.ts)
-  has no authentication of any kind and sets Access-Control-Allow-Origin: * on
-  every route, including the state-changing POST /approvals/:id/approve and
-  /deny. ApprovalInbox is the network surface of the human-in-the-loop Approval
-  Gate that gates high-risk operations (writes, shell commands, budget spend).
-  Any caller that can reach the inbox port — a co-located process, an SSRF, a
-  non-loopback remote client, or any website the operator visits in a browser
-  via the wildcard CORS — can enumerate pending approvals (GET /approvals/) and
-  approve them (POST /approvals/:id/approve) with no Authorization header,
-  defeating the Approval Gate so a gated shell command executes without
-  consent. Affected: network-ai <= 5.11.0.
-
-  Detection covers:
-  (a) a state-changing request to the approval control plane
+description: |
+  Detects GHSA-mxjx-28vx-xjjj (CWE-862 Missing Authorization + CWE-352 CSRF via wildcard CORS): network-ai's ApprovalInbox HTTP server (lib/approval-inbox.ts) has no authentication of any kind and sets Access-Control-Allow-Origin: * on every route, including the state-changing POST /approvals/:id/approve and /deny. ApprovalInbox is the network surface of the human-in-the-loop Approval Gate that gates high-risk operations (writes, shell commands, budget spend). Any caller that can reach the inbox port — a co-located process, an SSRF, a non-loopback remote client, or any website the operator visits in a browser via the wildcard CORS — can enumerate pending approvals (GET /approvals/) and approve them (POST /approvals/:id/approve) with no Authorization header, defeating the Approval Gate so a gated shell command executes without consent. Affected: network-ai <= 5.11.0.
+  Detection covers: (a) a state-changing request to the approval control plane
       (/approvals/<id>/approve or /deny) with no auth context, matching the
       unauthenticated-client PoC shape;
   (b) an enumeration request to the approval queue (GET /approvals/) paired
       with the wildcard-CORS marker on the approval control plane;
   (c) explicit GHSA-mxjx-28vx-xjjj / ApprovalInbox exploitation framing.
-
-  The detection target is the request shape at the approval control plane —
-  an unauthenticated approve/deny or enumerate call combined with the
-  wildcard-CORS marker — which is the exact bypass primitive, caught before
-  the gated action is released.
-author: "ATR Community"
-date: "2026/07/04"
-schema_version: "0.1"
+  The detection target is the request shape at the approval control plane — an unauthenticated approve/deny or enumerate call combined with the wildcard-CORS marker — which is the exact bypass primitive, caught before the gated action is released.
+author: ATR Community
+date: 2026/07/04
+schema_version: '0.1'
 detection_tier: pattern
 maturity: test
 severity: high
-
 references:
   owasp_llm:
-    - "LLM06:2025"
+    - LLM06:2025
   owasp_agentic:
-    - "ASI03:2026"
-    - "ASI06:2026"
+    - ASI03:2026
+    - ASI06:2026
   mitre_atlas:
-    - "AML.T0049 - Exploit Public-Facing Application"
+    - AML.T0049 - Exploit Public-Facing Application
   mitre_attack:
-    - "T1068 - Exploitation for Privilege Escalation"
-    - "T1190 - Exploit Public-Facing Application"
+    - T1068 - Exploitation for Privilege Escalation
+    - T1190 - Exploit Public-Facing Application
   ghsa:
-    - "GHSA-mxjx-28vx-xjjj"
-
+    - GHSA-mxjx-28vx-xjjj
 metadata_provenance:
   mitre_atlas: human-reviewed
   owasp_llm: human-reviewed
   owasp_agentic: human-reviewed
-
 compliance:
   eu_ai_act:
-    - { article: "15", context: "Article 15 cybersecurity — runtime detection of unauthenticated cross-origin approval-gate bypass on network-ai's ApprovalInbox control plane.", strength: primary }
-    - { article: "9",  context: "Article 9 risk management — runtime risk-treatment control for unauthenticated cross-origin approval-gate bypass.", strength: secondary }
+    - article: '15'
+      context: Article 15 cybersecurity — runtime detection of unauthenticated cross-origin approval-gate bypass on network-ai's ApprovalInbox control plane.
+      strength: primary
+    - article: '9'
+      context: Article 9 risk management — runtime risk-treatment control for unauthenticated cross-origin approval-gate bypass.
+      strength: secondary
   nist_ai_rmf:
-    - { subcategory: "MP.5.1", context: "MAP 5.1 — adversarial input characterised/detected for unauthenticated cross-origin approval-gate bypass.", strength: primary }
-    - { subcategory: "MG.3.2", context: "MANAGE 3.2 — runtime monitoring control for unauthenticated cross-origin approval-gate bypass.", strength: secondary }
+    - subcategory: MP.5.1
+      context: MAP 5.1 — adversarial input characterised/detected for unauthenticated cross-origin approval-gate bypass.
+      strength: primary
+    - subcategory: MG.3.2
+      context: MANAGE 3.2 — runtime monitoring control for unauthenticated cross-origin approval-gate bypass.
+      strength: secondary
   iso_42001:
-    - { clause: "8.1", context: "Clause 8.1 operational control — detection of unauthenticated cross-origin approval-gate bypass payload.", strength: primary }
-    - { clause: "8.3", context: "Clause 8.3 AI risk treatment — runtime detection as treatment control.", strength: secondary }
-
+    - clause: '8.1'
+      context: Clause 8.1 operational control — detection of unauthenticated cross-origin approval-gate bypass payload.
+      strength: primary
+    - clause: '8.3'
+      context: Clause 8.3 AI risk treatment — runtime detection as treatment control.
+      strength: secondary
 tags:
   category: privilege-escalation
   subcategory: unauth-approval-gate-bypass
@@ -72,7 +63,6 @@ tags:
   confidence: high
   source: ghsa-disclosure
   vendor_sources: network-ai-ghsa-mxjx-28vx-xjjj
-
 agent_source:
   type: tool_call
   framework:
@@ -80,72 +70,32 @@ agent_source:
     - any
   provider:
     - any
-
 detection:
   condition: any
   false_positives:
-    - "Legitimate operator approving a pending action through an authenticated ApprovalInbox deployment that has been hardened with a reverse-proxy auth layer — expected to match; review confirms intent."
-    - "Security advisory or PR text quoting the GHSA-mxjx-28vx-xjjj PoC."
-    - "A read-only status check against an endpoint that is not the approvals control plane."
+    - Legitimate operator approving a pending action through an authenticated ApprovalInbox deployment that has been hardened with a reverse-proxy auth layer — expected to match; review confirms intent.
+    - Security advisory or PR text quoting the GHSA-mxjx-28vx-xjjj PoC.
+    - A read-only status check against an endpoint that is not the approvals control plane.
   conditions:
     - field: content
       operator: regex
-      value: '(?i)POST\s+/approvals/[a-f0-9]+/(?:approve|deny)\b[\s\S]{0,300}(?:approvedBy["\x27]?\s*[:=]\s*["\x27]?(?:anonymous|attacker)|no\s+auth|Authorization["\x27]?\s*:\s*(?:null|undefined|absent|none))'
-      description: >
-        Unauthenticated POST to the approval control plane's approve/deny
-        route — approvedBy defaults to anonymous/attacker with no
-        Authorization header, matching the GHSA-mxjx-28vx-xjjj PoC shape.
+      value: (?i)POST\s+/approvals/[a-f0-9]+/(?:approve|deny)\b[\s\S]{0,300}(?:approvedBy["\x27]?\s*[:=]\s*["\x27]?(?:anonymous|attacker)|no\s+auth|Authorization["\x27]?\s*:\s*(?:null|undefined|absent|none))
+      description: |
+        Unauthenticated POST to the approval control plane's approve/deny route — approvedBy defaults to anonymous/attacker with no Authorization header, matching the GHSA-mxjx-28vx-xjjj PoC shape.
     - field: content
       operator: regex
-      value: '(?i)GET\s+/approvals/\??(?:status=pending)?\b[\s\S]{0,200}Access-Control-Allow-Origin["\x27]?\s*:\s*["\x27]?\*'
-      description: >
-        Enumeration of the pending-approvals queue paired with a wildcard
-        Access-Control-Allow-Origin marker on the approval control plane —
-        the cross-origin approval-inbox reconnaissance step.
+      value: (?i)GET\s+/approvals/\??(?:status=pending)?\b[\s\S]{0,200}Access-Control-Allow-Origin["\x27]?\s*:\s*["\x27]?\*
+      description: |
+        Enumeration of the pending-approvals queue paired with a wildcard Access-Control-Allow-Origin marker on the approval control plane — the cross-origin approval-inbox reconnaissance step.
     - field: content
       operator: regex
-      value: '(?i)GHSA-mxjx-28vx-xjjj[\s\S]{0,200}(?:approval[- ]?inbox|network-ai|approve|CORS)'
-      description: >
-        Explicit GHSA-mxjx-28vx-xjjj reference combined with ApprovalInbox
-        exploitation language — attack framing in a skill or tool
-        description.
-
+      value: (?i)GHSA-mxjx-28vx-xjjj[\s\S]{0,200}(?:approval[- ]?inbox|network-ai|approve|CORS)
+      description: |
+        Explicit GHSA-mxjx-28vx-xjjj reference combined with ApprovalInbox exploitation language — attack framing in a skill or tool description.
 response:
   actions:
     - alert
     - block_input
-  message_template: >
-    [ATR-2026-01981] HIGH: network-ai ApprovalInbox unauthenticated
-    cross-origin approval bypass detected (GHSA-mxjx-28vx-xjjj, CWE-862 +
-    CWE-352). A caller with no Authorization header reached the approval
-    control plane's approve/deny or enumeration route, defeating the
-    human-in-the-loop Approval Gate. Block the request and upgrade network-ai
-    past 5.11.0 / put ApprovalInbox behind an authenticated reverse proxy.
-
+  message_template: |
+    [ATR-2026-01981] HIGH: network-ai ApprovalInbox unauthenticated cross-origin approval bypass detected (GHSA-mxjx-28vx-xjjj, CWE-862 + CWE-352). A caller with no Authorization header reached the approval control plane's approve/deny or enumeration route, defeating the human-in-the-loop Approval Gate. Block the request and upgrade network-ai past 5.11.0 / put ApprovalInbox behind an authenticated reverse proxy.
 confidence: 78
-
-
-test_cases:
-  true_positives:
-    - tool_description: "POST /approvals/07d6f277efe35ac1/approve {\"approvedBy\": \"anonymous\"}"
-      expected: triggered
-      description: "Unauthenticated approve call defaults approvedBy to anonymous — GHSA-mxjx-28vx-xjjj PoC shape"
-    - tool_description: "GET /approvals/?status=pending -> 200, Access-Control-Allow-Origin: *"
-      expected: triggered
-      description: "Cross-origin enumeration of pending approvals via wildcard CORS marker"
-    - tool_description: "Exploiting GHSA-mxjx-28vx-xjjj: the network-ai ApprovalInbox has no auth, so I can approve any pending action via CORS."
-      expected: triggered
-      description: "Explicit GHSA-mxjx-28vx-xjjj ApprovalInbox exploitation framing"
-  true_negatives:
-    - tool_description: "POST /approvals/07d6f277efe35ac1/approve {\"approvedBy\": \"ops-lead\", \"Authorization\": \"Bearer sk_live_abc123\"}"
-      expected: not_triggered
-      description: "Authenticated operator approval with a Bearer token present"
-    - tool_description: "How does the ApprovalInbox approve/deny flow work in network-ai?"
-      expected: not_triggered
-      description: "General question about the feature, not an exploitation request"
-    - tool_description: "GET /approvals/health"
-      expected: not_triggered
-      description: "Read-only health check on an unrelated route, no wildcard CORS marker present"
-    - tool_description: "POST /approvals/07d6f277efe35ac1/approve {\"approvedBy\": \"ops-lead\"} behind an internal VPN with mTLS client cert required"
-      expected: not_triggered
-      description: "Approve call description explicitly noting mTLS-gated internal deployment, no anonymous/attacker/no-auth marker"