security-mcp 1.1.4 → 1.3.3

package/skills/file-upload-attacker/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `injection-deep` + `api` detection modules (`src/gate/checks/injection-deep.ts`, `src/gate/checks/api.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** a magic-byte check at the upload handler is bypassed if a separate thumbnail Lambda or CDN edge worker fetches the raw object from storage and renders it — trace the uploaded file from the upload route through storage to every downstream consumer (resizer, PDF extractor, archive unzipper) across files.
+- **Semantic / effective-state analysis:** model the upload taint chain — `originalname` → `path.join` (traversal), archive entry → symlink target (ZIP Slip via symlink, not just `../`), SVG `<image href>` → IMDS (SSRF), compression ratio → OOM (nested-archive bomb). Compute the effective execution context (same-origin serving = XSS/exec), not just the declared Content-Type.
+- **External corroboration:** WebSearch/WebFetch + OSV.dev for current CVEs in file-processing libs (`sharp`/ImageMagick/libvips) and polyglot-weaponisation advisories.
+- **Apply & prove:** write the fix inline (magic-byte allowlist, filename sanitisation, symlink-aware ZIP Slip guard, ratio cap, `Content-Disposition: attachment`, isolated serving origin), re-run the `injection-deep`/`api` checks plus `semgrep` and an `osv-scanner` sweep of image libs as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance
@@ -206,3 +215,112 @@ function checkArchiveBomb(compressedSize: number, uncompressedSize: number): voi
 - `requiredActions`: ordered action list
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "Upload endpoint accepts arbitrary filenames — manual ZIP Slip PoC advised", "exploitHint": "Craft zip with ../../../../.env entry and POST to /api/upload" }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "MD5 used for dedup hash of uploaded files", "location": "src/storage/fileDedup.ts" }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "Upload handler fetches remote URL for image import — no SSRF guard", "escalationPath": "Fetch http://169.254.169.254/latest/meta-data/ to exfiltrate IAM credentials" }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["PCI-DSS Req 6.2.4", "SOC 2 CC6.1"], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+- **AI-Generated Polyglot File Weaponisation (CWE-434 / ATT&CK T1190):** LLM-assisted tooling (e.g., PolyglotGen, custom GPT wrappers) auto-crafts files that simultaneously satisfy two parsers — a valid JPEG (JFIF header + EOI marker) with a PHP or Python webshell payload appended. Signature scanners match only the leading magic bytes and pass the file. Test by: upload a file produced with `polyglot-php-jpg` or manually appending `<?php system($_GET['cmd']); ?>` after the JPEG EOI (`\xFF\xD9`) marker, then request it at its storage URL with `?cmd=id`. Finding threshold: server executes the payload or returns non-404 with PHP output rather than serving raw bytes.
+
+- **ZIP Slip via Symlink Entry (CVE-2018-1002200 / ATT&CK T1083):** Standard path-traversal guards check `entry.name` for `../` sequences but do not verify symlink targets inside archives. A zip entry `link -> ../../../../etc/cron.d/` (symlink) followed by `link/backdoor` (regular file) passes the `isZipSlip` check on entry names, yet extraction writes `backdoor` to `/etc/cron.d/`. Test by: craft an archive with Python's `zipfile` module adding a `ZipInfo` with `external_attr = 0xA1ED0000` (symlink flag) pointing to a sensitive directory, then POST to the archive extraction endpoint. Finding threshold: file appears outside the designated extraction root, or the `isSymlink()` check is absent from extraction code.
+
+- **SVG SSRF via Thumbnail Pipeline Bypassing API-Layer Blocks (CVE-2022-44268 analogue / ATT&CK T1552.007):** The application-layer upload endpoint correctly rejects `image/svg+xml`, but a separate image-resizing Lambda or CDN edge function fetches and renders SVGs directly from the object storage bucket, bypassing all application controls. Payload: `<svg xmlns="http://www.w3.org/2000/svg"><image href="http://169.254.169.254/latest/meta-data/iam/security-credentials/"/></svg>`. Test by: upload the SVG directly to the storage bucket (bypassing the API) and trigger thumbnail generation via the CDN URL or resizing endpoint; monitor egress with a Burp Collaborator / interactsh callback. Finding threshold: HTTP request received at the callback host from the thumbnail worker IP range, or IMDSv1 credentials returned in the rendered output.
+
+- **Supply Chain Risk in File-Processing Libraries — ImageMagick / libvips CVE Churn (CVE-2023-34152, CVE-2024-28219):** ImageMagick and libvips have a persistent history of RCE and arbitrary file-read CVEs triggered by crafted image inputs (e.g., CVE-2023-34152: shell injection via filename passed to external delegate, CVE-2024-28219: buffer overflow in libvips TIFF decoder). Any Node.js service using `sharp`, `jimp`, or `gm` transitively depends on these libraries. Test by: run `npm ls sharp imagemagick gm` to enumerate transitive image-processing deps; cross-reference installed version against OSV.dev (`https://api.osv.dev/v1/query`) for open CVEs; attempt a CVE-2016-3714-style `|id` filename in the upload if using older ImageMagick. Finding threshold: installed library version has any open CVE with CVSS >= 7.0, or SBOM generation (`cyclonedx-npm`) is absent from the CI pipeline.
+
+- **Archive Bomb Nested Inside Allowed Container Format — Zip-in-PNG (CWE-400 / OWASP A05:2021):** A zip bomb is embedded as a PNG comment block or PDF attachment stream. The file passes magic-byte MIME validation (leading bytes are valid PNG or PDF), raw compressed size is within the upload limit, and antivirus scanners check only the outer container. The bomb detonates when a downstream thumbnail generator or PDF text-extractor recursively decompresses the inner archive. Test by: create a PNG with a `zTXt` chunk containing a 42.zip-style recursive deflate bomb (1 KB compressed, 4.5 PB uncompressed); upload as `photo.png`; trigger thumbnail generation and monitor worker disk/memory usage via CloudWatch or cgroups metrics. Finding threshold: worker process OOM-killed or disk usage spikes >10x the compressed upload size within 5 seconds of processing.
+
+- **Regulatory Gap — EU CRA / US EO 14028 SBOM Mandate for File-Processing Dependencies (ATT&CK T1195.001):** The EU Cyber Resilience Act (CRA, effective 2027) and US Executive Order 14028 require a machine-readable SBOM for any software handling user-uploaded content. File-processing libraries (libmagic, libarchive, Pillow, ImageMagick) are high-churn CVE surfaces that must appear in CycloneDX or SPDX SBOMs with exact version and license. Absence of SBOM generation in CI is itself a compliance gap. Test by: run `cyclonedx-npm --output sbom.json` (Node) or `cyclonedx-py --output sbom.json` (Python) and verify every file-processing dependency is enumerated; then query `https://api.osv.dev/v1/query` for each component. Finding threshold: any file-processing library absent from SBOM, or any SBOM component with an open CVE that has no documented remediation timeline in the project's risk register.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 file-upload attack cases that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Polyglot file valid in two formats simultaneously | Scanner validates magic bytes for one format only; browser or server consumes it as the other | Craft a file that is simultaneously a valid JPEG (JFIF header) and a valid JavaScript module or PHP script (payload appended after EOI marker); upload as `photo.jpg`, then request with `Accept: text/javascript` or rename via a second request |
+| 2 | Double-extension + null byte bypass | Regex checks `\.jpg$` and matches; server strips at null byte leaving `.php` | Upload `evil.php\x00.jpg` (URL-encoded `%00`) — on older stacks the null terminates the OS filename string, storing `evil.php` |
+| 3 | ZIP Slip via symlink inside archive | Path-traversal check validates entry names but not symlink targets; extractor follows symlink into sensitive dir | Create zip containing `link -> ../../../etc/cron.d/` (symlink entry) then `link/pwn` (file); standard `isZipSlip` check on the symlink name passes, but extraction writes outside destDir |
+| 4 | SVG with external entity / SSRF via `<image href>` | Scanner checks `image/svg+xml` is blocked globally but misses SVG accepted as "document" upload or in a separate endpoint | Upload `<svg><image href="http://169.254.169.254/latest/meta-data/"/>` as `.svg`; if server renders or thumbnails it, SSRF hits IMDSv1 |
+| 5 | Archive bomb nested inside allowed image format | Virus scanner and size check run on the raw compressed bytes; uncompressed size only visible after extraction | Embed a `zip` inside a valid PNG comment block or PDF attachment stream — file passes magic-byte MIME check and raw-size limit; extraction triggers resource exhaustion |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences around file upload must account for today.
+
+| Threat | Est. Timeline | Relevance to File Upload | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| AI-generated polyglot weaponisation at scale | 2025–2027 (active) | LLM tooling auto-generates polyglot files (PDF+PHP, PNG+JS) that evade static signature scanners | Adopt content-aware server-side scanning (ClamAV + YARA rules updated weekly); never trust magic bytes alone |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | File processing libraries (libmagic, libarchive, imagemagick) must appear in SBOM; CVEs surface fast | Generate CycloneDX SBOM per release; subscribe to OSV feeds for all file-processing dependencies |
+| EU AI Act enforcement for AI-powered content moderation | 2026 | If upload pipeline uses AI to classify or moderate content, it becomes a regulated AI system | Classify AI moderation components against AI Act risk tiers now; document human oversight procedures |
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | File integrity signatures (RSA/ECDSA over upload manifests) breakable retroactively | Migrate file-signing to ML-DSA (FIPS 204); inventory all RSA/ECDSA usage in upload verification |
+| Post-quantum TLS migration deadline | 2028–2030 | Files in transit protected only by classical TLS will be exposed by harvest-now-decrypt-later | Begin TLS agility assessment for upload endpoints; test hybrid key exchange (X25519+ML-KEM) |
+
+---
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in the file-upload domain, and what to build to close each gap.
+
+- **Polyglot file execution in downstream consumer**: The upload request looks like a valid JPEG (200 OK, magic bytes pass). The dangerous execution happens when a downstream renderer, thumbnail generator, or CDN edge worker processes the file. Monitoring only the upload endpoint misses this. Need: instrument file-processing workers to emit an event per file type inferred at execution time; alert when execution-time MIME differs from upload-time MIME.
+
+- **ZIP Slip via symlink**: Standard ZIP entry path checks validate names but not symlink targets. A symlink-based ZIP Slip leaves no anomalous path string in logs — the entry name looks safe. Need: add a YARA or custom rule that flags zip/tar archives containing symlink entries (`entry.isSymlink()`) before extraction; log and quarantine immediately.
+
+- **SVG SSRF from thumbnail pipeline**: The upload is rejected at the API boundary, but a misconfigured CDN or image-resizing Lambda still fetches and renders SVG from the storage bucket directly, bypassing application-layer controls. No application log event emitted. Need: monitor egress from image-processing infrastructure (VPC flow logs / CloudTrail); alert on outbound HTTP from thumbnail workers to RFC 1918 addresses or IMDSv2 endpoints.
+
+- **Archive bomb detonation during lazy extraction**: Size and ratio checks pass on the compressed archive (within limits). Extraction is deferred to a background job. By the time the bomb expands, the request is long complete — rate limiting and request-level WAF rules do not trigger. Need: enforce extraction quotas inside the background worker (inotify / disk-usage polling); kill and quarantine extraction jobs that exceed the uncompressed size budget mid-stream.
+
+- **Filename-based path traversal after rename**: Initial upload sanitises the filename. A subsequent rename or move API call re-introduces the original user-supplied name (e.g., from a metadata field stored at upload time). The traversal happens in the rename step, not the upload step. Need: re-validate sanitisation rules at every file-system operation that uses the filename, not just at upload time; treat stored `originalname` fields as untrusted input at every use site.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any file-upload attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+Attack classes that MUST be evidenced:
+- Magic-byte / MIME type validation
+- ZIP Slip (path traversal in archive extraction)
+- Archive bomb (compression ratio + uncompressed size limit)
+- SVG XSS and SVG SSRF
+- Filename sanitisation (null bytes, double extensions, path separators)
+- Polyglot file bypass
+- Stored file access control (auth required to retrieve, Content-Disposition enforced)
+- Upload-origin isolation (separate domain or CDN origin for served files)
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      { "class": "MIME Magic-Byte Validation", "filesReviewed": 12, "patterns": ["fileTypeFromBuffer", "magic", "mmmagic"], "result": "CLEAN" },
+      { "class": "ZIP Slip", "filesReviewed": 4, "patterns": ["path.resolve", "startsWith(destDir)", "adm-zip", "unzip"], "result": "2 findings, all fixed" },
+      { "class": "SVG XSS / SSRF", "filesReviewed": 12, "patterns": ["image/svg+xml", ".svg", "ALLOWED_MIME_TYPES"], "result": "CLEAN" }
+    ],
+    "filesReviewed": 28,
+    "negativeAssertions": ["SVG MIME type absent from ALLOWED_MIME_TYPES across all 12 upload handler files"],
+    "uncoveredReason": {}
+  }
+}
+```