blitzstrike 2.4.96 → 2.4.98
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +26 -0
- package/README.md +35 -8
- package/dist/index.js +227 -202
- package/intelligence/watchlist.json +352 -28
- package/package.json +1 -1
|
@@ -1,33 +1,357 @@
|
|
|
1
1
|
{
|
|
2
|
-
"_comment": "Bug-bounty disclosure frequency + payout watchlist. Derived from public disclosure statistics (HackerOne Hacktivity / CWE Top 25) and typical bounty ranges
|
|
2
|
+
"_comment": "Bug-bounty disclosure frequency + payout watchlist. Derived from public disclosure statistics (HackerOne Hacktivity / CWE Top 25) and typical bounty ranges \u2014 a 'what to hunt next' signal, not a vulnerability database. Each CWE entry links to a Blitz Strike detector pattern when one exists (grounding via pattern_lookup).",
|
|
3
3
|
"cwe_frequency": [
|
|
4
|
-
{
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
{
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
4
|
+
{
|
|
5
|
+
"cwe": "CWE-79",
|
|
6
|
+
"name": "Cross-site Scripting (XSS)",
|
|
7
|
+
"rank": 1,
|
|
8
|
+
"saturated": true,
|
|
9
|
+
"pattern": "xss",
|
|
10
|
+
"payout_min": 100,
|
|
11
|
+
"payout_max": 2500,
|
|
12
|
+
"notes": "Most-reported class; heavily automated and low-paying \u2014 hunt only for high-impact variants (stored/account-takeover)."
|
|
13
|
+
},
|
|
14
|
+
{
|
|
15
|
+
"cwe": "CWE-862",
|
|
16
|
+
"name": "Missing Authorization / IDOR",
|
|
17
|
+
"rank": 2,
|
|
18
|
+
"saturated": false,
|
|
19
|
+
"pattern": "missing_authz",
|
|
20
|
+
"payout_min": 1000,
|
|
21
|
+
"payout_max": 10000,
|
|
22
|
+
"notes": "~30% of paid access-control bugs; sibling rule + two-account test are the highest-ROI moves."
|
|
23
|
+
},
|
|
24
|
+
{
|
|
25
|
+
"cwe": "CWE-284",
|
|
26
|
+
"name": "Improper Access Control (priv-esc)",
|
|
27
|
+
"rank": 3,
|
|
28
|
+
"saturated": false,
|
|
29
|
+
"pattern": "priv_esc",
|
|
30
|
+
"payout_min": 1000,
|
|
31
|
+
"payout_max": 15000,
|
|
32
|
+
"notes": "Role/privilege escalation; mass assignment + forced membership are under-hunted."
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"cwe": "CWE-89",
|
|
36
|
+
"name": "SQL Injection",
|
|
37
|
+
"rank": 4,
|
|
38
|
+
"saturated": false,
|
|
39
|
+
"pattern": "sql_injection",
|
|
40
|
+
"payout_min": 1000,
|
|
41
|
+
"payout_max": 15000,
|
|
42
|
+
"notes": "Still high-value where it reaches a real query; WAF bypass + second-order matter."
|
|
43
|
+
},
|
|
44
|
+
{
|
|
45
|
+
"cwe": "CWE-918",
|
|
46
|
+
"name": "Server-Side Request Forgery (SSRF)",
|
|
47
|
+
"rank": 5,
|
|
48
|
+
"saturated": false,
|
|
49
|
+
"pattern": "ssrf",
|
|
50
|
+
"payout_min": 1000,
|
|
51
|
+
"payout_max": 15000,
|
|
52
|
+
"notes": "P1 when it hits cloud metadata; proof = internal response or OOB callback."
|
|
53
|
+
},
|
|
54
|
+
{
|
|
55
|
+
"cwe": "CWE-78",
|
|
56
|
+
"name": "OS Command Injection",
|
|
57
|
+
"rank": 6,
|
|
58
|
+
"saturated": false,
|
|
59
|
+
"pattern": "command_injection",
|
|
60
|
+
"payout_min": 1000,
|
|
61
|
+
"payout_max": 15000,
|
|
62
|
+
"notes": "Critical class; less common than XSS/SQLi but very high impact."
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"cwe": "CWE-502",
|
|
66
|
+
"name": "Insecure Deserialization",
|
|
67
|
+
"rank": 7,
|
|
68
|
+
"saturated": false,
|
|
69
|
+
"pattern": "deserialization",
|
|
70
|
+
"payout_min": 5000,
|
|
71
|
+
"payout_max": 30000,
|
|
72
|
+
"notes": "Highest per-finding payout; needs a gadget chain but very rewarded."
|
|
73
|
+
},
|
|
74
|
+
{
|
|
75
|
+
"cwe": "CWE-94",
|
|
76
|
+
"name": "Code Injection / eval",
|
|
77
|
+
"rank": 8,
|
|
78
|
+
"saturated": false,
|
|
79
|
+
"pattern": "command_injection",
|
|
80
|
+
"payout_min": 1000,
|
|
81
|
+
"payout_max": 15000,
|
|
82
|
+
"notes": "eval/exec with user input; folds into RCE umbrella."
|
|
83
|
+
},
|
|
84
|
+
{
|
|
85
|
+
"cwe": "CWE-434",
|
|
86
|
+
"name": "Unrestricted File Upload",
|
|
87
|
+
"rank": 9,
|
|
88
|
+
"saturated": false,
|
|
89
|
+
"pattern": "file_upload",
|
|
90
|
+
"payout_min": 1000,
|
|
91
|
+
"payout_max": 10000,
|
|
92
|
+
"notes": "Upload \u2192 RCE chains pay well; confirm the file actually executes."
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"cwe": "CWE-611",
|
|
96
|
+
"name": "XML External Entity (XXE)",
|
|
97
|
+
"rank": 10,
|
|
98
|
+
"saturated": false,
|
|
99
|
+
"pattern": "xxe",
|
|
100
|
+
"payout_min": 1000,
|
|
101
|
+
"payout_max": 10000,
|
|
102
|
+
"notes": "Less common post-2020 but still found in SOAP/XML upload flows."
|
|
103
|
+
},
|
|
104
|
+
{
|
|
105
|
+
"cwe": "CWE-287",
|
|
106
|
+
"name": "Authentication Bypass",
|
|
107
|
+
"rank": 11,
|
|
108
|
+
"saturated": false,
|
|
109
|
+
"pattern": "type_juggling",
|
|
110
|
+
"payout_min": 1000,
|
|
111
|
+
"payout_max": 15000,
|
|
112
|
+
"notes": "Loose comparison / JWT confusion / OAuth misconfig \u2014 account takeover class."
|
|
113
|
+
},
|
|
114
|
+
{
|
|
115
|
+
"cwe": "CWE-798",
|
|
116
|
+
"name": "Hardcoded Credentials",
|
|
117
|
+
"rank": 12,
|
|
118
|
+
"saturated": false,
|
|
119
|
+
"pattern": "hardcoded_secret",
|
|
120
|
+
"payout_min": 500,
|
|
121
|
+
"payout_max": 10000,
|
|
122
|
+
"notes": "Committed keys are common in JS bundles + .git history; prove the key is ACTIVE."
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"cwe": "CWE-22",
|
|
126
|
+
"name": "Path Traversal / LFI",
|
|
127
|
+
"rank": 13,
|
|
128
|
+
"saturated": true,
|
|
129
|
+
"pattern": "path_confusion",
|
|
130
|
+
"payout_min": 500,
|
|
131
|
+
"payout_max": 5000,
|
|
132
|
+
"notes": "Saturated; value only when it chains to RCE (log poisoning, session files)."
|
|
133
|
+
},
|
|
134
|
+
{
|
|
135
|
+
"cwe": "CWE-601",
|
|
136
|
+
"name": "Open Redirect",
|
|
137
|
+
"rank": 14,
|
|
138
|
+
"saturated": true,
|
|
139
|
+
"pattern": "oauth_misconfig",
|
|
140
|
+
"payout_min": 100,
|
|
141
|
+
"payout_max": 1500,
|
|
142
|
+
"notes": "Standalone is usually N/A; value only chained into OAuth/token theft."
|
|
143
|
+
},
|
|
144
|
+
{
|
|
145
|
+
"cwe": "CWE-352",
|
|
146
|
+
"name": "Cross-Site Request Forgery (CSRF)",
|
|
147
|
+
"rank": 15,
|
|
148
|
+
"saturated": true,
|
|
149
|
+
"pattern": "missing_nonce",
|
|
150
|
+
"payout_min": 100,
|
|
151
|
+
"payout_max": 2000,
|
|
152
|
+
"notes": "Saturated + low; only for high-impact state changes (password/email/transfer)."
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"cwe": "CWE-200",
|
|
156
|
+
"name": "Information Exposure",
|
|
157
|
+
"rank": 16,
|
|
158
|
+
"saturated": true,
|
|
159
|
+
"pattern": "hardcoded_secret",
|
|
160
|
+
"payout_min": 100,
|
|
161
|
+
"payout_max": 2000,
|
|
162
|
+
"notes": "Excessive data exposure / verbose errors; usually a chain enabler, not a standalone bounty."
|
|
163
|
+
},
|
|
164
|
+
{
|
|
165
|
+
"cwe": "CWE-400",
|
|
166
|
+
"name": "Denial of Service / rate-limit",
|
|
167
|
+
"rank": 17,
|
|
168
|
+
"saturated": true,
|
|
169
|
+
"pattern": null,
|
|
170
|
+
"payout_min": 100,
|
|
171
|
+
"payout_max": 1000,
|
|
172
|
+
"notes": "Usually out of scope standalone; relevant only for business-critical flows."
|
|
173
|
+
}
|
|
21
174
|
],
|
|
22
175
|
"cve_watchlist": [
|
|
23
|
-
{
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
176
|
+
{
|
|
177
|
+
"cve": "CVE-2021-26084",
|
|
178
|
+
"name": "Confluence OGNL injection RCE",
|
|
179
|
+
"product": "Atlassian Confluence",
|
|
180
|
+
"class": "rce",
|
|
181
|
+
"epss": 1.0,
|
|
182
|
+
"reports": 2669,
|
|
183
|
+
"fingerprint": "Confluence (Server/Data Center) \u2014 /login.action, confluence headers",
|
|
184
|
+
"match": "confluence|login\\.action|atlassian"
|
|
185
|
+
},
|
|
186
|
+
{
|
|
187
|
+
"cve": "CVE-2025-29927",
|
|
188
|
+
"name": "Next.js middleware auth bypass",
|
|
189
|
+
"product": "Next.js",
|
|
190
|
+
"class": "auth_bypass",
|
|
191
|
+
"epss": 0.9962,
|
|
192
|
+
"reports": 132,
|
|
193
|
+
"fingerprint": "_next/static/chunks/ bundles; x-middleware-subrequest header",
|
|
194
|
+
"match": "_next/|__next|next\\.js|middleware"
|
|
195
|
+
},
|
|
196
|
+
{
|
|
197
|
+
"cve": "CVE-2025-55182",
|
|
198
|
+
"name": "Next.js RSC pre-auth RCE (deserialization)",
|
|
199
|
+
"product": "Next.js / React Server Components",
|
|
200
|
+
"class": "rce",
|
|
201
|
+
"epss": 0.9956,
|
|
202
|
+
"reports": 415,
|
|
203
|
+
"fingerprint": "_next/ + Server Function / flight endpoints",
|
|
204
|
+
"match": "_next/|server function|react server|rsc"
|
|
205
|
+
},
|
|
206
|
+
{
|
|
207
|
+
"cve": "CVE-2025-3248",
|
|
208
|
+
"name": "Langflow unauth code injection",
|
|
209
|
+
"product": "Langflow",
|
|
210
|
+
"class": "rce",
|
|
211
|
+
"epss": 0.9997,
|
|
212
|
+
"reports": 29,
|
|
213
|
+
"fingerprint": "/api/v1/validate/code \u2014 AI/agent tooling",
|
|
214
|
+
"match": "langflow|validate/code"
|
|
215
|
+
},
|
|
216
|
+
{
|
|
217
|
+
"cve": "CVE-2024-34351",
|
|
218
|
+
"name": "Next.js Server Actions SSRF",
|
|
219
|
+
"product": "Next.js",
|
|
220
|
+
"class": "ssrf",
|
|
221
|
+
"epss": 0.0545,
|
|
222
|
+
"reports": 50,
|
|
223
|
+
"fingerprint": "Next.js Server Actions (Host header + relative redirect)",
|
|
224
|
+
"match": "_next/|server action"
|
|
225
|
+
},
|
|
226
|
+
{
|
|
227
|
+
"cve": "CVE-2025-0133",
|
|
228
|
+
"name": "PAN-OS GlobalProtect portal XSS",
|
|
229
|
+
"product": "Palo Alto PAN-OS",
|
|
230
|
+
"class": "xss",
|
|
231
|
+
"epss": 0.4352,
|
|
232
|
+
"reports": 1990,
|
|
233
|
+
"fingerprint": "GlobalProtect captive portal",
|
|
234
|
+
"match": "globalprotect|palo alto|pan-os|pan os"
|
|
235
|
+
},
|
|
236
|
+
{
|
|
237
|
+
"cve": "CVE-2026-0257",
|
|
238
|
+
"name": "PAN-OS GlobalProtect auth bypass",
|
|
239
|
+
"product": "Palo Alto PAN-OS / Prisma",
|
|
240
|
+
"class": "auth_bypass",
|
|
241
|
+
"epss": 0.8668,
|
|
242
|
+
"reports": 27,
|
|
243
|
+
"fingerprint": "GlobalProtect portal/gateway",
|
|
244
|
+
"match": "globalprotect|palo alto|pan-os|pan os"
|
|
245
|
+
},
|
|
246
|
+
{
|
|
247
|
+
"cve": "CVE-2025-4123",
|
|
248
|
+
"name": "Grafana XSS \u2192 SSRF chain",
|
|
249
|
+
"product": "Grafana",
|
|
250
|
+
"class": "xss",
|
|
251
|
+
"epss": 0.9781,
|
|
252
|
+
"reports": 220,
|
|
253
|
+
"fingerprint": "Grafana path traversal + open redirect (Image Renderer)",
|
|
254
|
+
"match": "grafana|x-grafana"
|
|
255
|
+
},
|
|
256
|
+
{
|
|
257
|
+
"cve": "CVE-2021-20323",
|
|
258
|
+
"name": "Keycloak reflected XSS (POST)",
|
|
259
|
+
"product": "Keycloak (Red Hat)",
|
|
260
|
+
"class": "xss",
|
|
261
|
+
"epss": 0.3725,
|
|
262
|
+
"reports": 107,
|
|
263
|
+
"fingerprint": "Keycloak auth flows",
|
|
264
|
+
"match": "keycloak|kc-|realms/"
|
|
265
|
+
},
|
|
266
|
+
{
|
|
267
|
+
"cve": "CVE-2018-5230",
|
|
268
|
+
"name": "Jira issue collector XSS",
|
|
269
|
+
"product": "Atlassian Jira",
|
|
270
|
+
"class": "xss",
|
|
271
|
+
"epss": 0.3761,
|
|
272
|
+
"reports": 4694,
|
|
273
|
+
"fingerprint": "Jira /issuecollector custom fields",
|
|
274
|
+
"match": "jira|issuecollector|atlassian"
|
|
275
|
+
},
|
|
276
|
+
{
|
|
277
|
+
"cve": "CVE-2026-33461",
|
|
278
|
+
"name": "Kibana Fleet endpoint authz (key/token leak)",
|
|
279
|
+
"product": "Elastic Kibana",
|
|
280
|
+
"class": "auth_bypass",
|
|
281
|
+
"epss": 0.0028,
|
|
282
|
+
"reports": 8,
|
|
283
|
+
"fingerprint": "Kibana internal Fleet endpoints",
|
|
284
|
+
"match": "kibana|elastic|fleet"
|
|
285
|
+
},
|
|
286
|
+
{
|
|
287
|
+
"cve": "CVE-2026-49093",
|
|
288
|
+
"name": "Kibana egress connector SSRF",
|
|
289
|
+
"product": "Elastic Kibana",
|
|
290
|
+
"class": "ssrf",
|
|
291
|
+
"epss": 0.002,
|
|
292
|
+
"reports": 5,
|
|
293
|
+
"fingerprint": "Kibana connectors / allowlist bypass",
|
|
294
|
+
"match": "kibana|elastic|connector"
|
|
295
|
+
},
|
|
296
|
+
{
|
|
297
|
+
"cve": "CVE-2026-26938",
|
|
298
|
+
"name": "Kibana Workflows template injection \u2192 file read/SSRF",
|
|
299
|
+
"product": "Elastic Kibana",
|
|
300
|
+
"class": "ssti",
|
|
301
|
+
"epss": 0.0025,
|
|
302
|
+
"reports": 5,
|
|
303
|
+
"fingerprint": "Kibana Workflows",
|
|
304
|
+
"match": "kibana|elastic|workflow"
|
|
305
|
+
},
|
|
306
|
+
{
|
|
307
|
+
"cve": "CVE-2026-33068",
|
|
308
|
+
"name": "Claude Code bypassPermissions via .claude/settings.json",
|
|
309
|
+
"product": "Claude Code",
|
|
310
|
+
"class": "priv_esc",
|
|
311
|
+
"epss": 0.0034,
|
|
312
|
+
"reports": 5,
|
|
313
|
+
"fingerprint": "repo .claude/settings.json",
|
|
314
|
+
"match": "\\.claude/settings"
|
|
315
|
+
},
|
|
316
|
+
{
|
|
317
|
+
"cve": "CVE-2025-25297",
|
|
318
|
+
"name": "Label Studio S3 endpoint SSRF",
|
|
319
|
+
"product": "Label Studio",
|
|
320
|
+
"class": "ssrf",
|
|
321
|
+
"epss": 0.0062,
|
|
322
|
+
"reports": 2,
|
|
323
|
+
"fingerprint": "Label Studio S3 integration",
|
|
324
|
+
"match": "label ?studio|labelstudio|label-studio"
|
|
325
|
+
},
|
|
326
|
+
{
|
|
327
|
+
"cve": "CVE-2026-33309",
|
|
328
|
+
"name": "Langflow arbitrary file write \u2192 RCE",
|
|
329
|
+
"product": "Langflow",
|
|
330
|
+
"class": "file_upload",
|
|
331
|
+
"epss": 0.0142,
|
|
332
|
+
"reports": 6,
|
|
333
|
+
"fingerprint": "Langflow multipart upload filename",
|
|
334
|
+
"match": "langflow"
|
|
335
|
+
},
|
|
336
|
+
{
|
|
337
|
+
"cve": "CVE-2026-45543",
|
|
338
|
+
"name": "Nextcloud Forms collaborator read retention",
|
|
339
|
+
"product": "Nextcloud Forms",
|
|
340
|
+
"class": "missing_authz",
|
|
341
|
+
"epss": 0.0027,
|
|
342
|
+
"reports": 5,
|
|
343
|
+
"fingerprint": "Nextcloud Forms collaborator removal",
|
|
344
|
+
"match": "nextcloud|ocs-provider"
|
|
345
|
+
},
|
|
346
|
+
{
|
|
347
|
+
"cve": "CVE-2017-15277",
|
|
348
|
+
"name": "ImageMagick GIF palette memory leak",
|
|
349
|
+
"product": "ImageMagick / GraphicsMagick",
|
|
350
|
+
"class": "infoleak",
|
|
351
|
+
"epss": 0.1919,
|
|
352
|
+
"reports": 5914,
|
|
353
|
+
"fingerprint": "image processing (GIF upload)",
|
|
354
|
+
"match": "imagemagick|graphicsmagick"
|
|
355
|
+
}
|
|
32
356
|
]
|
|
33
|
-
}
|
|
357
|
+
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "blitzstrike",
|
|
3
|
-
"version": "2.4.
|
|
3
|
+
"version": "2.4.98",
|
|
4
4
|
"description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"bin": {
|