blitzstrike 2.4.28 → 2.4.29

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.29] — 2026-09-14
+
+### Added — Enterprise compliance mapping (CWE -> frameworks)
+
+- New `src/compliance.ts`: data-driven mapping of 25 web/app CWEs to OWASP
+  Top 10 (2021), OWASP ASVS v4.0, PCI DSS v4.0, ISO 27001:2022 Annex A, and
+  NIST SP 800-53.
+- New `compliance` tool: map a single CWE or an aggregate list.
+- `generate_report` now emits a "## 6. Compliance Mapping" section — a CISO/
+  auditor can see which controls every finding violates, not just a CVSS.
+
 ## [2.4.28] — 2026-09-14
 
 ### Added — Enterprise Empirical Intelligence Ledger (LOOP 2, cross-target)

package/dist/index.js

@@ -33320,6 +33320,79 @@ function cvssAssess(input) {
   return { score, vector: cvssVector(input), severity: cvssSeverity(score) };
 }
 
+// src/compliance.ts
+var CWE_COMPLIANCE = {
+  "79": { name: "Cross-site Scripting (XSS)", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.3"], pci: ["6.5.7"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "89": { name: "SQL Injection", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.4"], pci: ["6.5.1"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "78": { name: "OS Command Injection", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.8"], pci: ["6.5.1"], iso: ["A.8.9"], nist: ["SI-10"] },
+  "94": { name: "Code Injection", owasp_top10: "A03:2021 Injection", asvs: ["V5.2.4"], pci: ["6.5.1"], iso: ["A.8.9"], nist: ["SI-10"] },
+  "918": { name: "Server-Side Request Forgery (SSRF)", owasp_top10: "A10:2021 SSRF", asvs: ["V5.2.6"], pci: ["6.5.6"], iso: ["A.8.20"], nist: ["SC-7"] },
+  "611": { name: "XXE", owasp_top10: "A05:2021 Security Misconfiguration", asvs: ["V5.5.2"], pci: ["6.5.3"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "502": { name: "Insecure Deserialization", owasp_top10: "A08:2021 Software and Data Integrity Failures", asvs: ["V5.5.1"], pci: ["6.5.2"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "22": { name: "Path Traversal", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V12.3.1"], pci: ["6.5.8"], iso: ["A.8.12"], nist: ["AC-3"] },
+  "601": { name: "Open Redirect", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V5.1.5"], pci: ["6.5.9"], iso: ["A.8.20"], nist: ["AC-3"] },
+  "434": { name: "Unrestricted File Upload", owasp_top10: "A03:2021 Injection", asvs: ["V12.3.2"], pci: ["6.5.5"], iso: ["A.8.12"], nist: ["SI-10"] },
+  "942": { name: "Permissive Cross-Origin Policy (CORS)", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V4.2.2"], pci: ["6.5.9"], iso: ["A.8.20"], nist: ["AC-4"] },
+  "287": { name: "Improper Authentication", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V2.1.1"], pci: ["7.1.1", "8.1.1"], iso: ["A.8.5"], nist: ["IA-2"] },
+  "1336": { name: "Server-Side Template Injection (SSTI)", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.12"], pci: ["6.5.1"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "915": { name: "Mass Assignment", owasp_top10: "A04:2021 Insecure Design", asvs: ["V5.1.2"], pci: ["6.5.4"], iso: ["A.8.2"], nist: ["AC-3"] },
+  "1321": { name: "Prototype Pollution", owasp_top10: "A03:2021 Injection", asvs: ["V5.3.12"], pci: ["6.5.2"], iso: ["A.8.26"], nist: ["SI-10"] },
+  "352": { name: "Cross-Site Request Forgery (CSRF)", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V4.2.2"], pci: ["6.5.9"], iso: ["A.8.5"], nist: ["AC-3"] },
+  "319": { name: "Cleartext Transmission of Sensitive Information", owasp_top10: "A02:2021 Cryptographic Failures", asvs: ["V9.1.1"], pci: ["4.1.1"], iso: ["A.8.24"], nist: ["SC-8"] },
+  "693": { name: "Protection Mechanism Failure", owasp_top10: "A05:2021 Security Misconfiguration", asvs: ["V14.2.1"], pci: ["6.5.x"], iso: ["A.8.8"], nist: ["SI-2"] },
+  "200": { name: "Exposure of Sensitive Information", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V7.4.1"], pci: ["6.5.x"], iso: ["A.8.11"], nist: ["AC-4"] },
+  "862": { name: "Missing Authorization", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V4.1.1"], pci: ["7.1.1"], iso: ["A.8.2"], nist: ["AC-3"] },
+  "639": { name: "Insecure Direct Object Reference (IDOR)", owasp_top10: "A01:2021 Broken Access Control", asvs: ["V4.1.2"], pci: ["7.1.1"], iso: ["A.8.2"], nist: ["AC-3"] },
+  "640": { name: "Weak Password Recovery", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V2.5.2"], pci: ["8.3.6"], iso: ["A.8.5"], nist: ["IA-5"] },
+  "798": { name: "Hard-coded Credentials", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V2.10.4"], pci: ["8.3.8"], iso: ["A.8.5"], nist: ["IA-5"] },
+  "327": { name: "Weak Cryptography", owasp_top10: "A02:2021 Cryptographic Failures", asvs: ["V6.2.1"], pci: ["3.5.1"], iso: ["A.8.24"], nist: ["SC-13"] },
+  "306": { name: "Missing Authentication for Critical Function", owasp_top10: "A07:2021 Identification and Authentication Failures", asvs: ["V1.2.1"], pci: ["8.1.1"], iso: ["A.8.5"], nist: ["IA-2"] }
+};
+function complianceMap(cwe) {
+  const id = (cwe ?? "").toUpperCase().replace(/^CWE-?/, "");
+  const m = CWE_COMPLIANCE[id];
+  if (!m)
+    return null;
+  return { cwe: `CWE-${id}`, ...m };
+}
+function complianceSummary(cwes) {
+  const by_owasp = {};
+  const by_asvs = {};
+  const by_pci = {};
+  const by_iso = {};
+  const by_nist = {};
+  const mappings = [];
+  let mapped = 0;
+  let unmapped = 0;
+  for (const cwe of cwes) {
+    if (!cwe) {
+      unmapped += 1;
+      continue;
+    }
+    const m = complianceMap(cwe);
+    if (!m) {
+      unmapped += 1;
+      continue;
+    }
+    mapped += 1;
+    if (m.owasp_top10)
+      by_owasp[m.owasp_top10] = (by_owasp[m.owasp_top10] ?? 0) + 1;
+    for (const a of m.asvs ?? [])
+      by_asvs[a] = (by_asvs[a] ?? 0) + 1;
+    for (const p of m.pci ?? [])
+      by_pci[p] = (by_pci[p] ?? 0) + 1;
+    for (const i of m.iso ?? [])
+      by_iso[i] = (by_iso[i] ?? 0) + 1;
+    for (const n of m.nist ?? [])
+      by_nist[n] = (by_nist[n] ?? 0) + 1;
+    if (!mappings.some((x) => x.cwe === m.cwe)) {
+      mappings.push({ cwe: m.cwe, name: m.name, owasp_top10: m.owasp_top10 ?? null, asvs: m.asvs ?? [], pci: m.pci ?? [], iso: m.iso ?? [], nist: m.nist ?? [] });
+    }
+  }
+  mappings.sort((a, b) => a.cwe.localeCompare(b.cwe));
+  return { total_mapped: mapped, total_unmapped: unmapped, by_owasp, by_asvs, by_pci, by_iso, by_nist, mappings };
+}
+
 // src/report.ts
 import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync5 } from "node:fs";
 import { join as join10 } from "node:path";
@@ -33482,7 +33555,34 @@ function reportMarkdown(findings, opts = {}) {
       lines.push("");
     });
   }
-  lines.push("## 6. Recommendations");
+  lines.push("## 6. Compliance Mapping");
+  lines.push("");
+  const comp = complianceSummary(findings.map((f) => f.classification?.cwe ?? null));
+  if (comp.total_mapped === 0) {
+    lines.push("No CWE-tagged findings to map.");
+  } else {
+    lines.push("Maps each finding's CWE to OWASP Top 10 (2021), OWASP ASVS v4.0, PCI DSS v4.0, ISO 27001:2022 (Annex A), and NIST SP 800-53.");
+    lines.push("");
+    for (const m of comp.mappings) {
+      lines.push(`- **${m.cwe}** ${m.name}`);
+      if (m.owasp_top10)
+        lines.push(`  - OWASP Top 10: \`${m.owasp_top10}\``);
+      if (m.asvs.length)
+        lines.push(`  - ASVS v4.0: \`${m.asvs.join(", ")}\``);
+      if (m.pci.length)
+        lines.push(`  - PCI DSS v4.0: \`${m.pci.join(", ")}\``);
+      if (m.iso.length)
+        lines.push(`  - ISO 27001:2022: \`${m.iso.join(", ")}\``);
+      if (m.nist.length)
+        lines.push(`  - NIST 800-53: \`${m.nist.join(", ")}\``);
+    }
+    if (comp.total_unmapped > 0) {
+      lines.push("");
+      lines.push(`_${comp.total_unmapped} finding(s) had no CWE and were not mapped._`);
+    }
+  }
+  lines.push("");
+  lines.push("## 7. Recommendations");
   lines.push("");
   if (findings.length === 0) {
     lines.push("No findings — no remediation required.");
@@ -33493,7 +33593,7 @@ function reportMarkdown(findings, opts = {}) {
     });
   }
   lines.push("");
-  lines.push("## 7. Appendix");
+  lines.push("## 8. Appendix");
   lines.push("");
   if (hypotheses.length) {
     lines.push("### Unverified hypotheses (kept for follow-up)");
@@ -57383,6 +57483,29 @@ ${statusLine}` : statusLine },
     const out = action === "hit_rates" ? hitRates(tech) : action === "top_vectors" ? topVectors(tech ?? "unknown", 10) : queryIntel({ vector, tech, outcome });
     return { content: [{ type: "text", text: JSON.stringify(out) }] };
   });
+  server.registerTool("compliance", {
+    title: "Map CWE(s) to compliance frameworks",
+    description: "COMPLIANCE: map a CWE (or a JSON array of CWEs from findings) to OWASP Top 10 (2021), OWASP ASVS v4.0, PCI DSS v4.0, ISO 27001:2022 Annex A, and NIST SP 800-53. Pass a single `cwe` for one mapping, or `cwes` (JSON array) for an aggregate summary. Tells a CISO/auditor which controls a finding violates.",
+    inputSchema: {
+      cwe: string2().optional().describe("A single CWE id (e.g. CWE-89 or 89)"),
+      cwes: string2().optional().describe("JSON array of CWE ids for an aggregate summary")
+    }
+  }, async ({ cwe, cwes }) => {
+    if (cwes) {
+      let arr;
+      try {
+        arr = JSON.parse(cwes);
+      } catch {
+        return { content: [{ type: "text", text: JSON.stringify({ error: "invalid cwes JSON" }) }] };
+      }
+      return { content: [{ type: "text", text: JSON.stringify(complianceSummary(arr)) }] };
+    }
+    const m = complianceMap(cwe ?? "");
+    if (!m) {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "CWE not in the compliance table", cwe, hint: "supported ids: 79, 89, 78, 94, 918, 611, 502, 22, 601, 434, 942, 287, 1336, 915, 1321, 352, 319, 693, 200, 862, 639, 640, 798, 327, 306" }) }] };
+    }
+    return { content: [{ type: "text", text: JSON.stringify(m) }] };
+  });
   server.registerTool("payload_lookup", {
     title: "Look up exploit payloads",
     description: "INTEL: find a payload collection (66 categories from PayloadsAllTheThings).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.28",
+  "version": "2.4.29",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {