blitzstrike 2.4.59 → 2.4.61

package/intelligence/cwe_map.json

@@ -58,6 +58,10 @@
     {"id": "hardcoded_secret", "cwe": "CWE-798", "name": "Use of Hard-coded Credentials"},
     {"id": "type_juggling", "cwe": "CWE-697", "name": "Incorrect Comparison"},
     {"id": "path_confusion", "cwe": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)"},
-    {"id": "wrong_sanitizer", "cwe": "CWE-20", "name": "Improper Input Validation"}
+    {"id": "wrong_sanitizer", "cwe": "CWE-20", "name": "Improper Input Validation"},
+    {"id": "llm_injection", "cwe": "CWE-77", "name": "Improper Neutralization of Special Elements used in a Command (LLM Prompt Injection)"},
+    {"id": "graphql_exposure", "cwe": "CWE-200", "name": "Exposure of Sensitive Information"},
+    {"id": "oauth_misconfig", "cwe": "CWE-601", "name": "URL Redirection to Untrusted Site (Open Redirect)"},
+    {"id": "grpc_reflection", "cwe": "CWE-200", "name": "Exposure of Sensitive Information"}
   ]
 }

package/intelligence/patterns.json

@@ -146,6 +146,42 @@
       "detection_signatures": ["secret field assigned a literal", "known secret format (JWT/AWS/GitHub/Slack/…) in source", "high-entropy token under a non-obvious name"],
       "chain_templates": ["api_key_leak_to_account_takeover", "appkey_leak_deserialization_rce", "default_creds_to_internal_pivot"],
       "references": ["CWE-798", "OWASP A02:2021 Cryptographic Failures"]
+    },
+    {
+      "id": "llm_injection",
+      "name": "LLM Prompt Injection",
+      "cwe": "CWE-77",
+      "real_world": "Untrusted text reaches an LLM call (chat/completion/invoke) without a prompt-injection boundary, letting the input override instructions, leak the system prompt, or steer the model into a privileged action.",
+      "detection_signatures": ["an LLM provider call (openai/anthropic/langchain/llm) with request input in scope", "no visible system-prompt boundary or output filtering"],
+      "chain_templates": [],
+      "references": ["CWE-77", "OWASP LLM01:2025 Prompt Injection"]
+    },
+    {
+      "id": "graphql_exposure",
+      "name": "GraphQL Introspection / Playground Exposure",
+      "cwe": "CWE-200",
+      "real_world": "GraphQL introspection or a playground is left enabled in production, exposing the full schema (every query/mutation/field) and enabling interactive querying for recon.",
+      "detection_signatures": ["introspection/playground/graphiql set true in a production-reachable config"],
+      "chain_templates": ["graphql_idor_to_data_theft", "graphql_batching_to_credential_stuffing"],
+      "references": ["CWE-200", "OWASP API2:2023 Broken Authentication"]
+    },
+    {
+      "id": "oauth_misconfig",
+      "name": "OAuth Redirect URI Misconfiguration",
+      "cwe": "CWE-601",
+      "real_world": "An OAuth redirect_uri/callback is fed by request input with no static allowlist, letting an attacker redirect the authorization code or token to an attacker-controlled endpoint.",
+      "detection_signatures": ["redirect_uri/callback fed by request input", "no allowlist/whitelist validation nearby"],
+      "chain_templates": ["oauth_redirect_bypass", "open_redirect_to_oauth_theft"],
+      "references": ["CWE-601", "OWASP A07:2021 Identification and Authentication Failures"]
+    },
+    {
+      "id": "grpc_reflection",
+      "name": "gRPC Reflection Exposed",
+      "cwe": "CWE-200",
+      "real_world": "gRPC server reflection is enabled, enumerating every service and method to any caller and leaking the API contract.",
+      "detection_signatures": ["enable_server_reflection / RegisterReflectionService in production code"],
+      "chain_templates": [],
+      "references": ["CWE-200"]
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.59",
+  "version": "2.4.61",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {