penthera 1.7.0 → 1.8.0

package/lib/references.json

@@ -30,6 +30,10 @@
       "meli2019bad",
       "basak2023secretbench"
     ],
+    "unchecked": [
+      "meli2019bad",
+      "basak2023secretbench"
+    ],
     "sqli": [
       "owaspwstg42",
       "owasp2025top10",
@@ -82,6 +86,11 @@
       "zimmermann2019small",
       "ladisa2023sok"
     ],
+    "runtime-advisory": [
+      "owaspwstg42",
+      "ncsc2024webapps",
+      "redhatbackporting"
+    ],
     "js-vulnerability": [
       "lauinger2017thou",
       "zimmermann2019small"
@@ -237,6 +246,11 @@
       "title": "The Protection of Information in Computer Systems",
       "url": "https://doi.org/10.1109/PROC.1975.9939"
     },
+    "schneier1999secure": {
+      "cite": "Schneier & Kelsey 1999",
+      "title": "Secure Audit Logs to Support Computer Forensics",
+      "url": "https://doi.org/10.1145/317087.317089"
+    },
     "shostack2014threat": {
       "cite": "Shostack 2014",
       "title": "Threat Modeling: Designing for Security",
@@ -417,6 +431,36 @@
       "title": "OWASP Top 10 for Agentic Applications for 2026",
       "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/"
     },
+    "amodei2016concrete": {
+      "cite": "Amodei et al. 2016",
+      "title": "Concrete Problems in AI Safety",
+      "url": "https://doi.org/10.48550/arXiv.1606.06565"
+    },
+    "baker2025monitoring": {
+      "cite": "Baker et al. 2025",
+      "title": "Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation",
+      "url": "https://doi.org/10.48550/arXiv.2503.11926"
+    },
+    "anthropic2026incidents": {
+      "cite": "Anthropic incidents (2026)",
+      "title": "Investigating Three Real-World Incidents in Our Cybersecurity Evaluations",
+      "url": "https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals"
+    },
+    "openai2026incident": {
+      "cite": "OpenAI incident report (2026)",
+      "title": "OpenAI–Hugging Face Incident: Technical Report",
+      "url": "https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf"
+    },
+    "metr2026investigation": {
+      "cite": "METR and Redwood (2026)",
+      "title": "Brief Independent Investigation of Agents' Behavior, Reasoning and Collaboration in the OpenAI / Hugging Face Hacking Incident",
+      "url": "https://metr.org/hugging-face-incident-report-aug-2026.pdf"
+    },
+    "zhong2025impossiblebench": {
+      "cite": "Zhong et al. 2025",
+      "title": "ImpossibleBench: Measuring LLMs' Propensity of Exploiting Test Cases",
+      "url": "https://doi.org/10.48550/arXiv.2510.20270"
+    },
     "owasp2025mcptop10": {
       "cite": "OWASP MCP Top 10",
       "title": "OWASP MCP Top 10",
@@ -446,6 +490,186 @@
       "cite": "SPDX License List",
       "title": "SPDX License List",
       "url": "https://spdx.org/licenses/"
+    },
+    "tabassi2023airmf": {
+      "cite": "NIST AI RMF",
+      "title": "Artificial Intelligence Risk Management Framework (AI RMF 1.0)",
+      "url": "https://doi.org/10.6028/NIST.AI.100-1"
+    },
+    "lee2002detecting": {
+      "cite": "Lee et al. 2002",
+      "title": "Detecting and Defending against Web-Server Fingerprinting",
+      "url": "https://doi.org/10.1109/CSAC.2002.1176304"
+    },
+    "kar2022httpfuzz": {
+      "cite": "Kar et al. 2022",
+      "title": "HTTPFuzz: Web Server Fingerprinting with HTTP Request Fuzzing",
+      "url": "https://doi.org/10.5220/0011328900003283"
+    },
+    "lavrenovs2018http": {
+      "cite": "Lavrenovs & Melon 2018",
+      "title": "HTTP Security Headers Analysis of Top One Million Websites",
+      "url": "https://doi.org/10.23919/CYCON.2018.8405025"
+    },
+    "lyon2009nmap": {
+      "cite": "Lyon 2009",
+      "title": "Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning",
+      "url": "https://nmap.org/book/vscan.html"
+    },
+    "durumeric2014heartbleed": {
+      "cite": "Durumeric et al. 2014",
+      "title": "The Matter of Heartbleed",
+      "url": "https://doi.org/10.1145/2663716.2663755"
+    },
+    "nappa2015clones": {
+      "cite": "Nappa et al. 2015",
+      "title": "The Attack of the Clones: A Study of the Impact of Shared Code on Vulnerability Patching",
+      "url": "https://doi.org/10.1109/SP.2015.48"
+    },
+    "li2017largescale": {
+      "cite": "Li & Paxson 2017",
+      "title": "A Large-Scale Empirical Study of Security Patches",
+      "url": "https://doi.org/10.1145/3133956.3134072"
+    },
+    "vasek2016hacking": {
+      "cite": "Vasek et al. 2016",
+      "title": "Hacking Is Not Random: A Case-Control Study of Webserver-Compromise Risk",
+      "url": "https://doi.org/10.1109/TDSC.2015.2427847"
+    },
+    "stock2016hey": {
+      "cite": "Stock et al. 2016",
+      "title": "Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability Notification",
+      "url": "https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/stock"
+    },
+    "zhang2018precise": {
+      "cite": "Zhang & Qian 2018",
+      "title": "Precise and Accurate Patch Presence Test for Binaries",
+      "url": "https://www.usenix.org/conference/usenixsecurity18/presentation/zhang-hang"
+    },
+    "ossfosvschema": {
+      "cite": "OSV schema",
+      "title": "Open Source Vulnerability Format",
+      "url": "https://ossf.github.io/osv-schema/"
+    },
+    "cisakev": {
+      "cite": "CISA KEV",
+      "title": "Known Exploited Vulnerabilities Catalog",
+      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
+    },
+    "first2023cvss4": {
+      "cite": "CVSS v4.0",
+      "title": "Common Vulnerability Scoring System Version 4.0: Specification Document",
+      "url": "https://www.first.org/cvss/v4.0/specification-document"
+    },
+    "oasis2022csaf": {
+      "cite": "CSAF 2.0",
+      "title": "Common Security Advisory Framework Version 2.0",
+      "url": "https://docs.oasis-open.org/csaf/csaf/v2.0/os/csaf-v2.0-os.html"
+    },
+    "endoflifedate": {
+      "cite": "endoflife.date",
+      "title": "endoflife.date",
+      "url": "https://endoflife.date/"
+    },
+    "phpsupported": {
+      "cite": "PHP supported versions",
+      "title": "Supported Versions",
+      "url": "https://www.php.net/supported-versions.php"
+    },
+    "phpsrcadvisories": {
+      "cite": "php-src security advisories",
+      "title": "Security Advisories for php/php-src",
+      "url": "https://github.com/php/php-src/security/advisories"
+    },
+    "httpdvulns24": {
+      "cite": "Apache httpd 2.4 vulnerabilities",
+      "title": "Apache HTTP Server 2.4 Vulnerabilities",
+      "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
+    },
+    "nodejsreleases": {
+      "cite": "Node.js releases",
+      "title": "Node.js Releases",
+      "url": "https://nodejs.org/en/about/previous-releases"
+    },
+    "pythondevguideversions": {
+      "cite": "Python version status",
+      "title": "Status of Python Versions",
+      "url": "https://devguide.python.org/versions/"
+    },
+    "nginxadvisories": {
+      "cite": "nginx security advisories",
+      "title": "nginx Security Advisories",
+      "url": "https://nginx.org/en/security_advisories.html"
+    },
+    "opensslvulns": {
+      "cite": "OpenSSL vulnerabilities",
+      "title": "Vulnerabilities",
+      "url": "https://openssl-library.org/news/vulnerabilities/"
+    },
+    "redhatbackporting": {
+      "cite": "Red Hat backporting",
+      "title": "Security Backporting Practice",
+      "url": "https://access.redhat.com/security/updates/backporting"
+    },
+    "ubuntusecurityfaq": {
+      "cite": "Ubuntu Security FAQ",
+      "title": "Security/FAQ",
+      "url": "https://wiki.ubuntu.com/SecurityTeam/FAQ"
+    },
+    "debiansecurityfaq": {
+      "cite": "Debian security FAQ",
+      "title": "Debian Security FAQ",
+      "url": "https://www.debian.org/security/faq"
+    },
+    "phpexposephp": {
+      "cite": "PHP expose\\_php",
+      "title": "Description of Core php.ini Directives: expose\\_php",
+      "url": "https://www.php.net/manual/en/ini.core.php"
+    },
+    "devcore2024cve4577": {
+      "cite": "DEVCORE CVE-2024-4577",
+      "title": "Security Alert: CVE-2024-4577 - PHP CGI Argument Injection Vulnerability",
+      "url": "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/"
+    },
+    "censys2024cve4577": {
+      "cite": "Censys CVE-2024-4577",
+      "title": "PHP-CGI Argument Injection Vulnerability Could Lead to Remote Code Execution",
+      "url": "https://censys.com/advisory/cve-2024-4577/"
+    },
+    "php2012cgi": {
+      "cite": "PHP CGI flaw (2012)",
+      "title": "PHP 5.3.12 and 5.4.2 and the CGI Flaw (CVE-2012-1823)",
+      "url": "https://www.php.net/archive/2012.php#id2012-05-06-1"
+    },
+    "nucleiphpdetect": {
+      "cite": "Nuclei php-detect",
+      "title": "nuclei-templates: php-detect.yaml",
+      "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/technologies/php-detect.yaml"
+    },
+    "php2026critical": {
+      "cite": "PHP advance notice (2026-10-20)",
+      "title": "Upcoming Critical PHP Security Release",
+      "url": "https://www.php.net/archive/2026.php#2026-10-20-1"
+    },
+    "ncscadvisories": {
+      "cite": "NCSC-NL Security Advisories",
+      "title": "Security Advisories",
+      "url": "https://advisories.ncsc.nl/"
+    },
+    "ncsc2024webapps": {
+      "cite": "NCSC ICT-beveiligingsrichtlijnen webapplicaties (2024)",
+      "title": "ICT-beveiligingsrichtlijnen voor webapplicaties",
+      "url": "https://www.ncsc.nl/api/media/sites/default/files/Richtlijn%20ICT%20beveiligingsrichtlijnen%20webapplicaties%2007-24_0.pdf"
+    },
+    "ncsc2015webapps": {
+      "cite": "NCSC ICT-beveiligingsrichtlijnen webapplicaties (2015)",
+      "title": "ICT-beveiligingsrichtlijnen voor webapplicaties: Richtlijnen",
+      "url": "https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2019/mei/01/ict-beveiligingsrichtlijnen-voor-webapplicaties/ICT-Beveiligingsrichtlijnen-voor-Webapplicaties-Richtlijnen-Leesversie.pdf"
+    },
+    "nos2026phpliveblog": {
+      "cite": "NOS liveblog (2026-10-21)",
+      "title": "Websites kwetsbaar voor softwarelek: RTL Nieuws, DigiD en MijnOverheid uit de lucht",
+      "url": "https://nos.nl/liveblog/2636066-websites-kwetsbaar-voor-softwarelek-digid-en-mijnoverheid-uit-de-lucht"
     }
   }
 }

package/lib/retirejs.js

@@ -18,7 +18,7 @@
  */
 import { readFileSync } from "node:fs";
 import { gunzipSync } from "node:zlib";
-import { safeFetch, currentEgress } from "../src/utils/http.js";
+import { safeFetch, currentEgress, readBody, readJson } from "../src/utils/http.js";
 
 // Upstream RetireJS repository. This previously pointed at a personal fork that
 // now 404s, which made every scan silently report "no vulnerable libraries".
@@ -60,7 +60,7 @@ async function loadLive() {
     const res = await safeFetch(url, { timeout: 15_000, probe: false, redirect: "follow" });
     if (!res || !res.ok) continue;
     try {
-      const db = await res.json();
+      const db = await readJson(res);
       if (db && typeof db === "object" && Object.keys(db).length > 0) {
         cachedLive = { db, source: "live", url };
         cachedAt = Date.now();
@@ -259,7 +259,7 @@ export async function scanJsLibraries(baseUrl, opts = {}) {
   // Fetch the target page HTML
   const res = await safeFetch(baseUrl, { timeout, probe: "retirejs", redirect: "follow" });
   if (!res || !res.ok) return result;
-  const html = await res.text().catch(() => "");
+  const html = await readBody(res).catch(() => "");
 
   // Extract script URLs and inline scripts
   const scripts = extractScripts(html, baseUrl);
@@ -298,7 +298,7 @@ export async function scanJsLibraries(baseUrl, opts = {}) {
 
         const jsRes = await safeFetch(scriptUrl, { timeout: 5_000, probe: "retirejs", redirect: "follow" });
         if (!jsRes || !jsRes.ok) continue;
-        const jsContent = await jsRes.text().catch(() => "");
+        const jsContent = await readBody(jsRes).catch(() => "");
         if (jsContent.length > 0) {
           detectedVersion = extractVersion(jsContent, libData.extractors.filecontent);
           if (detectedVersion) break;

package/lib/rules/advisories/advisories.json

@@ -0,0 +1,186 @@
+{
+  "kind": "runtime-advisory",
+  "rules": [
+    {
+      "id": "php-cve-2026-109618",
+      "product": "php",
+      "title": "PHP remote code execution via out-of-memory state corruption",
+      "severity": "critical",
+      "cves": [
+        "CVE-2026-109618"
+      ],
+      "ghsa": [
+        "GHSA-w8hw-w9fx-j79w"
+      ],
+      "cvss": {
+        "version": "4.0",
+        "score": 9.2
+      },
+      "fixed": [
+        {
+          "branch": "8.2",
+          "version": "8.2.35"
+        },
+        {
+          "branch": "8.3",
+          "version": "8.3.36"
+        },
+        {
+          "branch": "8.4",
+          "version": "8.4.27"
+        },
+        {
+          "branch": "8.5",
+          "version": "8.5.12"
+        }
+      ],
+      "source": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
+      "date": "2026-10-21",
+      "confidence": "confirmed",
+      "references": [
+        "phpsrcadvisories",
+        "php2026critical"
+      ],
+      "description": "php-src rates it Critical (CVSS 4.0 9.2): an out-of-memory error during multipart request parsing leaves request memory in an invalid state that shutdown then processes. php-src confirms it on Apache mod_php before any application code runs, finds FPM susceptible by source analysis, and FrankenPHP and LSAPI likely susceptible. Updating is the only complete mitigation; memory_limit=-1 is a partial workaround. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12; published 21 Oct 2026. PHP's security advisory of 21 Oct 2026 (https://www.php.net/archive/2026.php#2026-10-21-5) lists every web SAPI as at risk (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed), the risk highest for mod_php, and says Linux distributions and LTS vendors received the patches in advance, so distribution packages are fixed under their own version numbers."
+    },
+    {
+      "id": "php-cve-2026-109619",
+      "product": "php",
+      "title": "PHP remote code execution via stale global state (use after free across requests)",
+      "severity": "critical",
+      "cves": [
+        "CVE-2026-109619"
+      ],
+      "ghsa": [
+        "GHSA-6wmf-4rv5-p3rp"
+      ],
+      "cvss": {
+        "version": "4.0",
+        "score": 9.2
+      },
+      "fixed": [
+        {
+          "branch": "8.2",
+          "version": "8.2.35"
+        },
+        {
+          "branch": "8.3",
+          "version": "8.3.36"
+        },
+        {
+          "branch": "8.4",
+          "version": "8.4.27"
+        },
+        {
+          "branch": "8.5",
+          "version": "8.5.12"
+        }
+      ],
+      "source": "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp",
+      "date": "2026-10-21",
+      "confidence": "confirmed",
+      "references": [
+        "phpsrcadvisories",
+        "php2026critical"
+      ],
+      "description": "php-src rates it Critical (CVSS 4.0 9.2): worker-global state that points into a freed request heap is read by the next request on the same worker before initialization resets it. Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12; published 21 Oct 2026. PHP's security advisory of 21 Oct 2026 (https://www.php.net/archive/2026.php#2026-10-21-5) lists every web SAPI as at risk (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed), the risk highest for mod_php, and says Linux distributions and LTS vendors received the patches in advance, so distribution packages are fixed under their own version numbers."
+    },
+    {
+      "id": "php-cve-2024-4577",
+      "product": "php",
+      "title": "PHP-CGI argument injection on Windows (bypass of CVE-2012-1823)",
+      "severity": "high",
+      "cves": [
+        "CVE-2024-4577"
+      ],
+      "ghsa": [
+        "GHSA-3qgc-jrrr-25jv"
+      ],
+      "condition": "PHP runs as CGI (php-cgi, for example through Apache with an Action/SetHandler to php-cgi) on Windows, where code-page conversion of the query string re-enables argument injection",
+      "fixed": [
+        {
+          "branch": "8.1",
+          "version": "8.1.29"
+        },
+        {
+          "branch": "8.2",
+          "version": "8.2.20"
+        },
+        {
+          "branch": "8.3",
+          "version": "8.3.8"
+        }
+      ],
+      "source": "https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv",
+      "date": "2024-06-06",
+      "confidence": "confirmed",
+      "description": "Reported by Orange Tsai (DEVCORE). The php-src advisory rates it High and lists the patched versions 8.1.29, 8.2.20 and 8.3.8 (PHP 8 ChangeLog, 6 June 2024).",
+      "references": [
+        "phpsrcadvisories",
+        "devcore2024cve4577",
+        "censys2024cve4577",
+        "cisakev"
+      ],
+      "kev": "2024-06-12"
+    },
+    {
+      "id": "php-cve-2024-8926",
+      "product": "php",
+      "title": "PHP-CGI parameter injection on Windows (bypass of CVE-2024-4577)",
+      "severity": "medium",
+      "cves": [
+        "CVE-2024-8926"
+      ],
+      "ghsa": [
+        "GHSA-p99j-rfp4-xqvq"
+      ],
+      "condition": "PHP runs as CGI on Windows with a non-standard code-page setting (the ACP code page pointed at an OEM code page in the registry), which php-src calls unlikely in a real environment",
+      "fixed": [
+        {
+          "branch": "8.1",
+          "version": "8.1.30"
+        },
+        {
+          "branch": "8.2",
+          "version": "8.2.24"
+        },
+        {
+          "branch": "8.3",
+          "version": "8.3.12"
+        }
+      ],
+      "source": "https://github.com/php/php-src/security/advisories/GHSA-p99j-rfp4-xqvq",
+      "date": "2024-09-26",
+      "confidence": "confirmed",
+      "description": "The php-src advisory rates it Moderate and lists the patched versions 8.1.30, 8.2.24 and 8.3.12 (PHP 8 ChangeLog, 26 September 2024).",
+      "references": [
+        "phpsrcadvisories"
+      ]
+    },
+    {
+      "id": "httpd-cve-2021-41773-42013",
+      "product": "apache-httpd",
+      "title": "Path traversal and remote code execution in Apache HTTP Server 2.4.49 and 2.4.50",
+      "severity": "critical",
+      "cves": [
+        "CVE-2021-41773",
+        "CVE-2021-42013"
+      ],
+      "condition": "Files outside Alias-like directories are not protected by the default \"require all denied\"; remote code execution also needs CGI enabled for those paths",
+      "fixed": [
+        {
+          "branch": "2.4",
+          "version": "2.4.51",
+          "introduced": "2.4.49"
+        }
+      ],
+      "source": "https://httpd.apache.org/security/vulnerabilities_24.html",
+      "date": "2021-10-07",
+      "confidence": "confirmed",
+      "description": "CVE-2021-41773 affected only 2.4.49 and its fix in 2.4.50 was incomplete (CVE-2021-42013), so 2.4.49 and 2.4.50 are affected and 2.4.51 fixes both, per the Apache HTTP Server 2.4 vulnerabilities page.",
+      "references": [
+        "httpdvulns24"
+      ]
+    }
+  ]
+}