blitzstrike 2.4.94 → 2.4.96

package/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.96] — 2026-09-17
+
+### Security — self-audit (command injection + path traversal fixed)
+
+- `resolve_check(host)` interpolated the user-controlled host into a `curl` shell
+  string (`execSync`), allowing command injection (`host = "x.com; id"`). Now
+  validates the host against a strict hostname regex BEFORE any subprocess/DNS and
+  calls curl via `execFileSync` (array argv, no shell) — defense in depth.
+- `foundry_run(contract_name=...)` used the name as a filename under the temp
+  project without validation, allowing path traversal (`"../../evil"`). Now
+  sanitizes to a valid Solidity identifier (`[A-Za-z_][A-Za-z0-9_]*`), defaulting
+  to `Vulnerable` otherwise.
+- Added regression checks: `isValidHostname` rejects shell metacharacters
+  (`;`, backticks, `$()`, `|`, `../`, newlines); the identifier regex is shared.
+
+## [2.4.95] — 2026-09-17
+
+### Fixed — full interconnection audit (unreachable template + 2 ungrounded classes)
+
+- `auto_poc` `open_redirect` template was UNREACHABLE: `canonicalId("open_redirect")`
+  resolves to `oauth_misconfig`, but the template key was `open_redirect`, so the
+  lookup fell back to the `missing_authz` recipe. Renamed the key to the canonical
+  `oauth_misconfig` + added an interconn invariant that every auto-poc key IS its
+  own canonical id.
+- `nosql_injection` and `host_header` were referenced across intel/orchestrator/
+  writeup/technique-lookup but had no pattern, severity, or synonym (ungrounded).
+  Added full patterns (CWE-943 / CWE-644), severity VRT entries (P1 critical /
+  P3 medium), and synonyms (nosql/mongo injection; host-header poisoning /
+  password-reset poisoning). cwe_map already carried both CWEs.
+- `SINK_TO_VECTOR` mapped the `code_execution` sink to a non-pattern vector name;
+  now maps to `command_injection` (consistent with the "code execution" synonym).
+
 ## [2.4.94] — 2026-09-17
 
 ### Added — Hunting intel (DNS sinkhole detection + CWE/CVE watchlist)

package/dist/index.js

@@ -17499,7 +17499,7 @@ var init_update = __esm(() => {
 import { readFileSync as readFileSync29, existsSync as existsSync16 } from "node:fs";
 import { join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath14 } from "node:url";
-import { execSync as execSync5 } from "node:child_process";
+import { execSync as execSync4 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
@@ -17516,13 +17516,13 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync5("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
     checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
   }
   try {
-    const published = execSync5("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const published = execSync4("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
   } catch {
     checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
@@ -34262,7 +34262,7 @@ var SINK_TO_VECTOR = {
   sql_execution: "sql_injection",
   command_execution: "command_injection",
   html_render: "xss",
-  code_execution: "code_execution",
+  code_execution: "command_injection",
   http_request: "ssrf",
   deserialization: "deserialization",
   file_operations: "path_traversal",
@@ -34545,7 +34545,16 @@ var ALIASES = {
   "subdomain takeover": "subdomain_takeover",
   takeover: "subdomain_takeover",
   "dangling dns": "subdomain_takeover",
-  "dangling cname": "subdomain_takeover"
+  "dangling cname": "subdomain_takeover",
+  "nosql injection": "nosql_injection",
+  nosql: "nosql_injection",
+  nosqli: "nosql_injection",
+  "mongo injection": "nosql_injection",
+  "mongodb injection": "nosql_injection",
+  "host header": "host_header",
+  "host header injection": "host_header",
+  "host header poisoning": "host_header",
+  "password reset poisoning": "host_header"
 };
 function normalize(term) {
   return term.trim().toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
@@ -59037,6 +59046,8 @@ var VRT_MAP = {
   sql_injection: { vrt: "injection > sql_injection", priority: "P1", severity: "critical", rationale: "SQL injection reaches sensitive data or enables admin takeover." },
   ssti: { vrt: "injection > server_side_template_injection", priority: "P1", severity: "critical", rationale: "SSTI evaluates expressions server-side → code execution." },
   command_injection: { vrt: "injection > os_command_injection", priority: "P1", severity: "critical", rationale: "User input reaches a shell (system/exec/popen) → arbitrary command execution, full host takeover." },
+  nosql_injection: { vrt: "injection > nosql_injection", priority: "P1", severity: "critical", rationale: "NoSQL operator injection reaches a database query → auth bypass or data exfiltration." },
+  host_header: { vrt: "injection > host_header_injection", priority: "P3", severity: "medium", rationale: "A reflected/trusted Host header can poison password-reset links or enable cache poisoning → account takeover in the right flow." },
   deserialization: { vrt: "injection > insecure_deserialization", priority: "P1", severity: "critical", rationale: "Deserialization escalated via a gadget chain → code execution." },
   xxe: { vrt: "injection > xml_external_entity", priority: "P1", severity: "critical", rationale: "XXE reads local files or reaches internal services." },
   file_upload: { vrt: "insecure_design > unrestricted_file_upload", priority: "P1", severity: "critical", rationale: "A web-reachable uploaded file of an executable type → code execution." },
@@ -61257,7 +61268,7 @@ var POC_TEMPLATES = {
     expected: `The response contains an injected \`X-Injected: ${MK}\` header.`,
     fix: "Strip CR/LF from any value placed into a response header."
   },
-  open_redirect: {
+  oauth_misconfig: {
     severity: "medium",
     marker: "https://attacker.example",
     request: (i) => qs(i, encodeURIComponent("https://attacker.example")),
@@ -61397,7 +61408,8 @@ function parseTestResults(out) {
 }
 async function foundryRun(input) {
   const forge = findForge();
-  const name = input.contract_name ?? "Vulnerable";
+  const rawName = input.contract_name ?? "Vulnerable";
+  const name = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(rawName) ? rawName : "Vulnerable";
   if (!forge) {
     return {
       forge: null,
@@ -61448,11 +61460,15 @@ solc = "0.8.20"
 }
 
 // src/hunting-intel.ts
-import { execSync as execSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { resolve4 as resolve42, Resolver } from "node:dns/promises";
 import { readFileSync as readFileSync25 } from "node:fs";
 import { join as join24 } from "node:path";
 var BLOCKING_KEYWORDS = /internet positif|kominfo|\.go\.id\b|pemblokiran|ditutup|dilarang|akses dibatasi|blocked|restricted|illegal|advertencia|coljuegos|regulat|forbidden|this (site|website) has been (blocked|banned)/i;
+var HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+function isValidHostname(host) {
+  return host.length <= 253 && HOSTNAME_RE.test(host);
+}
 async function localResolve(host) {
   try {
     return await resolve42(host);
@@ -61473,7 +61489,7 @@ function probeBlockingPage(host, ip, timeoutMs = 8000) {
   for (const port of ["443", "80"]) {
     const scheme = port === "443" ? "https" : "http";
     try {
-      const out = execSync4(`curl -sk -m 6 --resolve ${host}:${port}:${ip} ${scheme}://${host}/ 2>/dev/null`, { encoding: "utf8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"] });
+      const out = execFileSync5("curl", ["-sk", "-m", "6", "--resolve", `${host}:${port}:${ip}`, `${scheme}://${host}/`], { encoding: "utf8", timeout: timeoutMs, stdio: ["ignore", "pipe", "ignore"] });
       const preview = out.replace(/\s+/g, " ").trim().slice(0, 300);
       if (!preview)
         continue;
@@ -61484,6 +61500,9 @@ function probeBlockingPage(host, ip, timeoutMs = 8000) {
 }
 async function resolveCheck(host) {
   const clean = host.replace(/^https?:\/\//, "").split("/")[0];
+  if (!isValidHostname(clean)) {
+    return { host: clean, local_ips: [], public_ips: [], sinkhole: false, verdict: "invalid", evidence: "not a valid hostname — rejected before DNS/subprocess" };
+  }
   const local = await localResolve(clean);
   const pub = await publicResolve(clean);
   if (local.length === 0 && pub.length === 0) {

package/intelligence/patterns.json

@@ -988,6 +988,69 @@
       "payout_min": 1000,
       "payout_max": 15000,
       "typical_payout": "$1K\u2013$15K"
+    },
+    {
+      "id": "nosql_injection",
+      "name": "NoSQL Injection",
+      "cwe": "CWE-943",
+      "real_world": "User input reaches a NoSQL query (MongoDB $where/$gt/$ne, an unsanitized find/aggregate). Attackers inject operators to bypass authentication or dump collections.",
+      "detection_signatures": [
+        "unsanitized input into a NoSQL find/where/aggregate",
+        "operator injection ($ne/$gt/$where) from request input"
+      ],
+      "chain_templates": [
+        "nosql_injection_to_data_theft"
+      ],
+      "references": [
+        "CWE-943",
+        "OWASP A03:2021 Injection"
+      ],
+      "bypass_techniques": [
+        "operator injection ($ne/$gt/$where)",
+        "JSON-body operator injection",
+        "array/object type juggling to slip past input filters",
+        "blind extraction via regex/timing"
+      ],
+      "crown_jewels": [
+        "user/account collections",
+        "password hashes",
+        "admin documents"
+      ],
+      "severity": "critical",
+      "payout_min": 1000,
+      "payout_max": 15000,
+      "typical_payout": "$1K\u2013$15K"
+    },
+    {
+      "id": "host_header",
+      "name": "Host Header Injection",
+      "cwe": "CWE-644",
+      "real_world": "The app trusts the Host header for link generation, password-reset URLs, or routing. An attacker injects a malicious host to poison password-reset links or bypass access controls.",
+      "detection_signatures": [
+        "Host header reflected into a generated URL / Location / Set-Cookie",
+        "Host header used in password-reset link generation"
+      ],
+      "chain_templates": [
+        "http_smuggling_to_auth_bypass"
+      ],
+      "references": [
+        "CWE-644"
+      ],
+      "bypass_techniques": [
+        "Host header override via X-Forwarded-Host",
+        "absolute-URL host injection",
+        "password-reset link poisoning",
+        "web cache poisoning via Host"
+      ],
+      "crown_jewels": [
+        "password-reset tokens",
+        "account takeover via poisoned links",
+        "cache poisoning"
+      ],
+      "severity": "medium",
+      "payout_min": 500,
+      "payout_max": 5000,
+      "typical_payout": "$500\u2013$5K"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.94",
+  "version": "2.4.96",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {