blitzstrike 2.4.94 → 2.4.95

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.95] — 2026-09-17
+
+### Fixed — full interconnection audit (unreachable template + 2 ungrounded classes)
+
+- `auto_poc` `open_redirect` template was UNREACHABLE: `canonicalId("open_redirect")`
+  resolves to `oauth_misconfig`, but the template key was `open_redirect`, so the
+  lookup fell back to the `missing_authz` recipe. Renamed the key to the canonical
+  `oauth_misconfig` + added an interconn invariant that every auto-poc key IS its
+  own canonical id.
+- `nosql_injection` and `host_header` were referenced across intel/orchestrator/
+  writeup/technique-lookup but had no pattern, severity, or synonym (ungrounded).
+  Added full patterns (CWE-943 / CWE-644), severity VRT entries (P1 critical /
+  P3 medium), and synonyms (nosql/mongo injection; host-header poisoning /
+  password-reset poisoning). cwe_map already carried both CWEs.
+- `SINK_TO_VECTOR` mapped the `code_execution` sink to a non-pattern vector name;
+  now maps to `command_injection` (consistent with the "code execution" synonym).
+
 ## [2.4.94] — 2026-09-17
 
 ### Added — Hunting intel (DNS sinkhole detection + CWE/CVE watchlist)

package/dist/index.js

@@ -34262,7 +34262,7 @@ var SINK_TO_VECTOR = {
   sql_execution: "sql_injection",
   command_execution: "command_injection",
   html_render: "xss",
-  code_execution: "code_execution",
+  code_execution: "command_injection",
   http_request: "ssrf",
   deserialization: "deserialization",
   file_operations: "path_traversal",
@@ -34545,7 +34545,16 @@ var ALIASES = {
   "subdomain takeover": "subdomain_takeover",
   takeover: "subdomain_takeover",
   "dangling dns": "subdomain_takeover",
-  "dangling cname": "subdomain_takeover"
+  "dangling cname": "subdomain_takeover",
+  "nosql injection": "nosql_injection",
+  nosql: "nosql_injection",
+  nosqli: "nosql_injection",
+  "mongo injection": "nosql_injection",
+  "mongodb injection": "nosql_injection",
+  "host header": "host_header",
+  "host header injection": "host_header",
+  "host header poisoning": "host_header",
+  "password reset poisoning": "host_header"
 };
 function normalize(term) {
   return term.trim().toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
@@ -59037,6 +59046,8 @@ var VRT_MAP = {
   sql_injection: { vrt: "injection > sql_injection", priority: "P1", severity: "critical", rationale: "SQL injection reaches sensitive data or enables admin takeover." },
   ssti: { vrt: "injection > server_side_template_injection", priority: "P1", severity: "critical", rationale: "SSTI evaluates expressions server-side → code execution." },
   command_injection: { vrt: "injection > os_command_injection", priority: "P1", severity: "critical", rationale: "User input reaches a shell (system/exec/popen) → arbitrary command execution, full host takeover." },
+  nosql_injection: { vrt: "injection > nosql_injection", priority: "P1", severity: "critical", rationale: "NoSQL operator injection reaches a database query → auth bypass or data exfiltration." },
+  host_header: { vrt: "injection > host_header_injection", priority: "P3", severity: "medium", rationale: "A reflected/trusted Host header can poison password-reset links or enable cache poisoning → account takeover in the right flow." },
   deserialization: { vrt: "injection > insecure_deserialization", priority: "P1", severity: "critical", rationale: "Deserialization escalated via a gadget chain → code execution." },
   xxe: { vrt: "injection > xml_external_entity", priority: "P1", severity: "critical", rationale: "XXE reads local files or reaches internal services." },
   file_upload: { vrt: "insecure_design > unrestricted_file_upload", priority: "P1", severity: "critical", rationale: "A web-reachable uploaded file of an executable type → code execution." },
@@ -61257,7 +61268,7 @@ var POC_TEMPLATES = {
     expected: `The response contains an injected \`X-Injected: ${MK}\` header.`,
     fix: "Strip CR/LF from any value placed into a response header."
   },
-  open_redirect: {
+  oauth_misconfig: {
     severity: "medium",
     marker: "https://attacker.example",
     request: (i) => qs(i, encodeURIComponent("https://attacker.example")),

package/intelligence/patterns.json

@@ -988,6 +988,69 @@
       "payout_min": 1000,
       "payout_max": 15000,
       "typical_payout": "$1K\u2013$15K"
+    },
+    {
+      "id": "nosql_injection",
+      "name": "NoSQL Injection",
+      "cwe": "CWE-943",
+      "real_world": "User input reaches a NoSQL query (MongoDB $where/$gt/$ne, an unsanitized find/aggregate). Attackers inject operators to bypass authentication or dump collections.",
+      "detection_signatures": [
+        "unsanitized input into a NoSQL find/where/aggregate",
+        "operator injection ($ne/$gt/$where) from request input"
+      ],
+      "chain_templates": [
+        "nosql_injection_to_data_theft"
+      ],
+      "references": [
+        "CWE-943",
+        "OWASP A03:2021 Injection"
+      ],
+      "bypass_techniques": [
+        "operator injection ($ne/$gt/$where)",
+        "JSON-body operator injection",
+        "array/object type juggling to slip past input filters",
+        "blind extraction via regex/timing"
+      ],
+      "crown_jewels": [
+        "user/account collections",
+        "password hashes",
+        "admin documents"
+      ],
+      "severity": "critical",
+      "payout_min": 1000,
+      "payout_max": 15000,
+      "typical_payout": "$1K\u2013$15K"
+    },
+    {
+      "id": "host_header",
+      "name": "Host Header Injection",
+      "cwe": "CWE-644",
+      "real_world": "The app trusts the Host header for link generation, password-reset URLs, or routing. An attacker injects a malicious host to poison password-reset links or bypass access controls.",
+      "detection_signatures": [
+        "Host header reflected into a generated URL / Location / Set-Cookie",
+        "Host header used in password-reset link generation"
+      ],
+      "chain_templates": [
+        "http_smuggling_to_auth_bypass"
+      ],
+      "references": [
+        "CWE-644"
+      ],
+      "bypass_techniques": [
+        "Host header override via X-Forwarded-Host",
+        "absolute-URL host injection",
+        "password-reset link poisoning",
+        "web cache poisoning via Host"
+      ],
+      "crown_jewels": [
+        "password-reset tokens",
+        "account takeover via poisoned links",
+        "cache poisoning"
+      ],
+      "severity": "medium",
+      "payout_min": 500,
+      "payout_max": 5000,
+      "typical_payout": "$500\u2013$5K"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.94",
+  "version": "2.4.95",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {