blitzstrike 2.4.110 → 2.4.112

package/CHANGELOG.md

@@ -5,6 +5,42 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.112] — 2026-09-17
+
+### Added — nuclei-templates CVE corpus (watchlist 35 → 4,100+ fingerprints)
+
+- New `intelligence/cve-corpus.json` (4,113 CVEs) derived from the canonical
+  `projectdiscovery/nuclei-templates` `http/cves/**` tree via
+  `scripts/sync-cve-corpus.py` (re-runnable after `nuclei -update-templates`).
+  Each entry carries product name + severity + EPSS + CWE + a word-boundary
+  `match` regex built from product-name tokens + fofa/shodan query keywords
+  (NOT matcher payload words, which are too generic).
+- `watchlistCveMatches` / `live_recon` now match against the hand-curated
+  watchlist (version-precise) AND the corpus (long-tail), ranked by EPSS then
+  severity, capped at 20, with the hand-curated entry overriding the corpus for
+  the same CVE. Generic infra tokens (php/apache/mysql/powered/…) are excluded
+  so a plain PHP/HTML target yields ZERO false matches — regression-tested
+  (plain php → 0; vite/gradio/ollama/n8n → their specific CVEs).
+
+## [2.4.111] — 2026-09-17
+
+### Added — CVE watchlist expanded 18 → 35 (2025-2026 fingerprints)
+
+- Added 17 actively-exploited 2025-2026 CVEs to `intelligence/watchlist.json`
+  with fingerprints + fixed versions, wired into `watchlistCveMatches` /
+  `live_recon` fingerprint-first: n8n unauth/auth RCE (CVE-2026-21858/21877),
+  D-Link DSL RCE (CVE-2026-0625), Veeam RCE (CVE-2025-59470), Cisco SD-WAN
+  auth bypass (CVE-2026-20127), Gradio path-traversal + SSRF
+  (CVE-2026-28414/28416), FortiOS LDAP leak (CVE-2026-25815), Dell
+  RecoverPoint hardcoded creds (CVE-2026-22769), Statamic XSS
+  (CVE-2026-28426), Chartbrew SQLi + MongoDB RCE (CVE-2026-27005/25887),
+  Apache Camel header injection (CVE-2026-31650), Jenkins script-console RCE
+  (CVE-2026-30170), GraphQL introspection leak (CVE-2026-29812), Ollama path
+  traversal (CVE-2026-32154), Spring Boot actuator env leak (CVE-2026-33001).
+- Tightened two over-broad fingerprint regexes (dropped the standalone
+  "workflow" keyword that false-positived n8n↔Kibana); regression-tested
+  fingerprint precision (n8n ≠ kibana).
+
 ## [2.4.110] — 2026-09-17
 
 ### Added — hash length extension + concrete payload enrichment

package/dist/index.js

@@ -36376,6 +36376,27 @@ function loadWatchlist() {
   const data = JSON.parse(raw);
   return { cwe_frequency: data.cwe_frequency ?? [], cve_watchlist: data.cve_watchlist ?? [] };
 }
+function loadCorpus() {
+  try {
+    const raw = readFileSync11(join12(ROOT4, "intelligence", "cve-corpus.json"), "utf8");
+    const data = JSON.parse(raw);
+    return (data.cves ?? []).map((c) => ({
+      cve: String(c.cve ?? ""),
+      name: String(c.name ?? ""),
+      product: String(c.product ?? ""),
+      class: "",
+      epss: typeof c.epss === "number" ? c.epss : parseFloat(String(c.epss ?? "0")) || 0,
+      reports: 0,
+      fingerprint: String(c.product ?? ""),
+      match: typeof c.match === "string" ? c.match : undefined,
+      fixed_in: null,
+      version_key: null,
+      severity: typeof c.severity === "string" ? c.severity : undefined
+    }));
+  } catch {
+    return [];
+  }
+}
 function fmtPayout(min, max) {
   if (min == null || max == null)
     return "n/a";
@@ -36417,31 +36438,42 @@ function semverLt(a, b) {
   }
   return false;
 }
-function watchlistCveMatches(techs, headers = {}, body = "", versions = []) {
+function watchlistCveMatches(techs, headers = {}, body = "", versions = [], max = 20) {
   const { cve_watchlist } = loadWatchlist();
+  const corpus = loadCorpus();
   const haystack = `${techs.join(" ")} ${Object.keys(headers).join(" ")} ${Object.values(headers).join(" ")} ${body}`.toLowerCase();
-  return cve_watchlist.filter((c) => {
+  const curated = new Map(cve_watchlist.map((c) => [c.cve, c]));
+  const merged = [...corpus.filter((c) => !curated.has(c.cve)), ...cve_watchlist];
+  const matched = merged.filter((c) => {
     const m = c.match;
     if (!m)
       return false;
-    let matched = false;
+    let ok = false;
     try {
-      matched = new RegExp(m, "i").test(haystack);
+      ok = new RegExp(m, "i").test(haystack);
     } catch {
-      matched = false;
+      ok = false;
     }
-    if (!matched)
+    if (!ok)
       return false;
     const fixedIn = c.fixed_in;
     const vkey = c.version_key;
     if (fixedIn && vkey) {
       const v = versions.find((x) => x.product.toLowerCase().includes(vkey.toLowerCase()));
-      if (v?.version && !semverLt(v.version, fixedIn)) {
+      if (v?.version && !semverLt(v.version, fixedIn))
         return false;
-      }
     }
     return true;
   });
+  const sevRank = { critical: 0, high: 1, medium: 2, low: 3 };
+  matched.sort((a, b) => {
+    const ea = a.epss ?? 0;
+    const eb = b.epss ?? 0;
+    if (ea !== eb)
+      return eb - ea;
+    return (sevRank[a.severity ?? ""] ?? 9) - (sevRank[b.severity ?? ""] ?? 9);
+  });
+  return matched.slice(0, max);
 }
 
 // src/surface-map.ts
@@ -59801,7 +59833,7 @@ function loadDir(dir) {
   } catch {}
   return entries;
 }
-function loadCorpus() {
+function loadCorpus2() {
   return [...loadDir(CORPUS), ...loadDir(CAPTURED_CORPUS_DIR)];
 }
 function captureFalsePositive(input) {
@@ -59858,7 +59890,7 @@ function detect(entry) {
   return { detected: false };
 }
 function runBenchmark() {
-  const entries = loadCorpus();
+  const entries = loadCorpus2();
   const results = entries.map((entry) => {
     const { detected, sinkKind } = detect(entry);
     const outcome = entry.vulnerable ? detected ? "tp" : "fn" : detected ? "fp" : "tn";