fourisnotrandom 0.1.0__tar.gz

fourisnotrandom-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 FourIsNotRandom
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

fourisnotrandom-0.1.0/PKG-INFO

@@ -0,0 +1,122 @@
+Metadata-Version: 2.4
+Name: fourisnotrandom
+Version: 0.1.0
+Summary: Detection-only CLI that fingerprints versions/config for known CVE exposure (no exploit payloads).
+Author: FourIsNotRandom
+License: MIT
+Keywords: cve,security,fingerprint,detection-only
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: typer>=0.12
+Requires-Dist: rich>=13
+Requires-Dist: PyYAML>=6
+Requires-Dist: cryptography>=42
+Requires-Dist: requests>=2.31
+Requires-Dist: packaging>=23
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Dynamic: license-file
+
+# FourIsNotRandom
+
+Detection-only CLI (`fourisnotrandom`) that fingerprints software versions and TLS/CA configuration to report exposure to a small set of currently relevant advisories.
+
+> **This tool performs read-only version/fingerprint checks only. It does not exploit, does not send attack payloads, and must only be run against systems you own or are authorized to assess.**
+
+## What it checks
+
+| Area | Advisories | Detection methods |
+|------|------------|-------------------|
+| PHP | CVE-2026-109618, CVE-2026-109619 | Local `php -v`/`php -i`, HTTP headers, Docker/FS manifests, webroot app stacks |
+| eMudhra CA | CVE-2026-111943 / related distrust | TLS chain digests, PEM/keystore files, Docker CA bundles, Go + certifi versions |
+| GitLab | CVE-2026-110264, CVE-2026-97229 | Public `/help` or `/api/v4/version` (read-only) |
+| LiteLLM | Malicious `1.107.0` release | Exact pin in pip env / requirements / lockfiles / Docker |
+
+No CIDR sweeps: every run requires an explicit host, URL, path, image name, or a targets file of discrete entries.
+
+## Install
+
+```bash
+python -m pip install -U pip
+pip install -e ".[dev]"
+fourisnotrandom --help
+```
+
+### Auditing this tool's own dependencies
+
+Run `pip-audit` against the pinned requirements file - **not** bare `pip-audit`:
+
+```bash
+pip-audit -r requirements.txt
+```
+
+A bare `pip-audit` run audits your entire environment and will also flag the
+venv's bootstrap `pip` package, which is unrelated to this tool's dependencies.
+Use `pip-audit -r requirements.txt` so findings reflect only what this project
+declares.
+
+## Usage
+
+```bash
+# PHP
+fourisnotrandom php --local
+fourisnotrandom php --local --php-bin /usr/bin/php8.3
+fourisnotrandom php --url https://example.com/
+fourisnotrandom php --fs /var/www/html
+
+# eMudhra / toolchains
+fourisnotrandom emudhra --host example.com
+fourisnotrandom emudhra --path /etc/ssl/certs
+fourisnotrandom emudhra --docker my-image:tag
+fourisnotrandom emudhra --toolchains
+
+# GitLab (both CVSS 10.0 CVEs evaluated separately)
+fourisnotrandom gitlab --url https://gitlab.example.com
+
+# LiteLLM exact compromised pin
+fourisnotrandom litellm --env
+fourisnotrandom litellm --path .
+fourisnotrandom litellm --docker ghcr.io/berriai/litellm:v1.107.0
+
+# Explicit target list only (global flags before the subcommand)
+fourisnotrandom --format json all --targets-file targets.txt
+fourisnotrandom --format json emudhra toolchains
+```
+
+Exit codes: `0` = no FAIL, `1` = at least one FAIL, `2` = tool/config error.
+
+## Advisory data (editable)
+
+Bundled under `src/fourisnotrandom/data/`:
+
+| File | Contents | How to refresh |
+|------|----------|----------------|
+| `fixed_versions.yaml` | PHP floors, GitLab per-CVE floors, Go floors, certifi floor, LiteLLM pin | Edit YAML; or pass `--config PATH` |
+| `compromised_hashes.json` | Compromised eMudhra intermediate digests | Replace file or `fourisnotrandom update-hashes --from PATH` |
+| `php_apps.yaml` | CMS/webroot path fingerprints | Edit YAML |
+
+### Data provenance
+
+- **PHP floors**: PHP project security releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Branches ≤8.1 have no upstream fix.
+- **GitLab**: Official critical patch notes for CVE-2026-110264 (Oct 21) and CVE-2026-97229 (Oct 12). Both are reported separately so an Oct-12-only patch does not look “fully covered.”
+- **eMudhra hashes**: Certificate SHA-256 fingerprints from Cisco Talos “Compromised eMudhra intermediate certificates” (Oct 21, 2026), citing Mozilla Bugzilla 2083449. The scanner matches **either** full-cert SHA-256 **or** SPKI SHA-256 against the configured set (Talos publishes cert fingerprints; Go’s CVE-2026-111943 fix matches SPKI - dual match avoids assuming hash type after a refresh).
+- **certifi**: Floor `2026.10.18` (first release blocking compromised roots). `2026.10.19` restores some legitimate emSign roots (stability), not a security boundary.
+- **Go**: Fixed in 1.27.3 / 1.26.10 (CVE-2026-111943).
+- **LiteLLM**: Exact malicious PyPI/Docker release `1.107.0` only.
+
+```bash
+# Refresh eMudhra hash list from a JSON file with the same schema
+fourisnotrandom update-hashes --from ./my-hashes.json
+```
+
+## Safety
+
+> **Read-only / authorized use only.** This tool fingerprints versions and TLS/CA
+> material. It does not exploit, does not send attack payloads, and must only be
+> run against systems you own or are authorized to assess.
+
+- Fingerprints only: versions, headers, banners, cert digests, read-only `php.ini` values.
+- Does **not** send session.upload_progress exploits, memory-corruption probes, or any PoC payloads.
+- Does **not** scan networks you did not name explicitly.
+- Rejects CIDR ranges and bare wildcards - every target must be an explicit host, URL, or path.

fourisnotrandom-0.1.0/README.md

@@ -0,0 +1,102 @@
+# FourIsNotRandom
+
+Detection-only CLI (`fourisnotrandom`) that fingerprints software versions and TLS/CA configuration to report exposure to a small set of currently relevant advisories.
+
+> **This tool performs read-only version/fingerprint checks only. It does not exploit, does not send attack payloads, and must only be run against systems you own or are authorized to assess.**
+
+## What it checks
+
+| Area | Advisories | Detection methods |
+|------|------------|-------------------|
+| PHP | CVE-2026-109618, CVE-2026-109619 | Local `php -v`/`php -i`, HTTP headers, Docker/FS manifests, webroot app stacks |
+| eMudhra CA | CVE-2026-111943 / related distrust | TLS chain digests, PEM/keystore files, Docker CA bundles, Go + certifi versions |
+| GitLab | CVE-2026-110264, CVE-2026-97229 | Public `/help` or `/api/v4/version` (read-only) |
+| LiteLLM | Malicious `1.107.0` release | Exact pin in pip env / requirements / lockfiles / Docker |
+
+No CIDR sweeps: every run requires an explicit host, URL, path, image name, or a targets file of discrete entries.
+
+## Install
+
+```bash
+python -m pip install -U pip
+pip install -e ".[dev]"
+fourisnotrandom --help
+```
+
+### Auditing this tool's own dependencies
+
+Run `pip-audit` against the pinned requirements file - **not** bare `pip-audit`:
+
+```bash
+pip-audit -r requirements.txt
+```
+
+A bare `pip-audit` run audits your entire environment and will also flag the
+venv's bootstrap `pip` package, which is unrelated to this tool's dependencies.
+Use `pip-audit -r requirements.txt` so findings reflect only what this project
+declares.
+
+## Usage
+
+```bash
+# PHP
+fourisnotrandom php --local
+fourisnotrandom php --local --php-bin /usr/bin/php8.3
+fourisnotrandom php --url https://example.com/
+fourisnotrandom php --fs /var/www/html
+
+# eMudhra / toolchains
+fourisnotrandom emudhra --host example.com
+fourisnotrandom emudhra --path /etc/ssl/certs
+fourisnotrandom emudhra --docker my-image:tag
+fourisnotrandom emudhra --toolchains
+
+# GitLab (both CVSS 10.0 CVEs evaluated separately)
+fourisnotrandom gitlab --url https://gitlab.example.com
+
+# LiteLLM exact compromised pin
+fourisnotrandom litellm --env
+fourisnotrandom litellm --path .
+fourisnotrandom litellm --docker ghcr.io/berriai/litellm:v1.107.0
+
+# Explicit target list only (global flags before the subcommand)
+fourisnotrandom --format json all --targets-file targets.txt
+fourisnotrandom --format json emudhra toolchains
+```
+
+Exit codes: `0` = no FAIL, `1` = at least one FAIL, `2` = tool/config error.
+
+## Advisory data (editable)
+
+Bundled under `src/fourisnotrandom/data/`:
+
+| File | Contents | How to refresh |
+|------|----------|----------------|
+| `fixed_versions.yaml` | PHP floors, GitLab per-CVE floors, Go floors, certifi floor, LiteLLM pin | Edit YAML; or pass `--config PATH` |
+| `compromised_hashes.json` | Compromised eMudhra intermediate digests | Replace file or `fourisnotrandom update-hashes --from PATH` |
+| `php_apps.yaml` | CMS/webroot path fingerprints | Edit YAML |
+
+### Data provenance
+
+- **PHP floors**: PHP project security releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Branches ≤8.1 have no upstream fix.
+- **GitLab**: Official critical patch notes for CVE-2026-110264 (Oct 21) and CVE-2026-97229 (Oct 12). Both are reported separately so an Oct-12-only patch does not look “fully covered.”
+- **eMudhra hashes**: Certificate SHA-256 fingerprints from Cisco Talos “Compromised eMudhra intermediate certificates” (Oct 21, 2026), citing Mozilla Bugzilla 2083449. The scanner matches **either** full-cert SHA-256 **or** SPKI SHA-256 against the configured set (Talos publishes cert fingerprints; Go’s CVE-2026-111943 fix matches SPKI - dual match avoids assuming hash type after a refresh).
+- **certifi**: Floor `2026.10.18` (first release blocking compromised roots). `2026.10.19` restores some legitimate emSign roots (stability), not a security boundary.
+- **Go**: Fixed in 1.27.3 / 1.26.10 (CVE-2026-111943).
+- **LiteLLM**: Exact malicious PyPI/Docker release `1.107.0` only.
+
+```bash
+# Refresh eMudhra hash list from a JSON file with the same schema
+fourisnotrandom update-hashes --from ./my-hashes.json
+```
+
+## Safety
+
+> **Read-only / authorized use only.** This tool fingerprints versions and TLS/CA
+> material. It does not exploit, does not send attack payloads, and must only be
+> run against systems you own or are authorized to assess.
+
+- Fingerprints only: versions, headers, banners, cert digests, read-only `php.ini` values.
+- Does **not** send session.upload_progress exploits, memory-corruption probes, or any PoC payloads.
+- Does **not** scan networks you did not name explicitly.
+- Rejects CIDR ranges and bare wildcards - every target must be an explicit host, URL, or path.

fourisnotrandom-0.1.0/pyproject.toml

@@ -0,0 +1,37 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "fourisnotrandom"
+version = "0.1.0"
+description = "Detection-only CLI that fingerprints versions/config for known CVE exposure (no exploit payloads)."
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.10"
+authors = [{ name = "FourIsNotRandom" }]
+keywords = ["cve", "security", "fingerprint", "detection-only"]
+dependencies = [
+  "typer>=0.12",
+  "rich>=13",
+  "PyYAML>=6",
+  "cryptography>=42",
+  "requests>=2.31",
+  "packaging>=23",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8"]
+
+[project.scripts]
+fourisnotrandom = "fourisnotrandom.cli:app"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+fourisnotrandom = ["data/*.yaml", "data/*.json"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]

fourisnotrandom-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

fourisnotrandom-0.1.0/src/fourisnotrandom/__init__.py

@@ -0,0 +1,3 @@
+"""FourIsNotRandom: detection-only CVE exposure fingerprinting."""
+
+__version__ = "0.1.0"

fourisnotrandom-0.1.0/src/fourisnotrandom/__main__.py

@@ -0,0 +1,6 @@
+from fourisnotrandom.cli import app
+
+if __name__ == "__main__":
+    # Disable Click's Windows argv glob expansion so a literal "*" is rejected
+    # by TargetError instead of being expanded into a directory sweep.
+    app(windows_expand_args=False)

fourisnotrandom-0.1.0/src/fourisnotrandom/checks/__init__.py

@@ -0,0 +1 @@
+"""Detection-only check modules."""

fourisnotrandom-0.1.0/src/fourisnotrandom/checks/apps.py

@@ -0,0 +1,81 @@
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Any
+
+from fourisnotrandom.config_loader import load_php_apps
+from fourisnotrandom.models import Finding, Status
+
+
+def detect_php_apps(
+    root: Path,
+    php_version: str | None = None,
+    php_status: str | None = None,
+    apps_config: dict[str, Any] | None = None,
+) -> list[Finding]:
+    """Detect common PHP application stacks under a webroot (read-only)."""
+    cfg = apps_config or load_php_apps()
+    findings: list[Finding] = []
+    root = Path(root)
+
+    for app in cfg.get("apps", []):
+        name = app.get("name", "unknown")
+        matched = False
+        version_hint = ""
+        for marker in app.get("markers", []):
+            rel = marker.get("path")
+            if not rel:
+                continue
+            path = root / rel
+            if not path.is_file():
+                continue
+            try:
+                text = path.read_text(encoding="utf-8", errors="ignore")
+            except OSError:
+                continue
+            contains = marker.get("contains")
+            if contains and contains not in text:
+                continue
+            pattern = marker.get("pattern")
+            if pattern:
+                m = re.search(pattern, text)
+                if not m:
+                    continue
+                version_hint = m.group(1).strip() if m.lastindex else ""
+            matched = True
+            break
+
+        if not matched:
+            continue
+
+        if php_status == "FAIL":
+            status = Status.FAIL
+            remediation = (
+                f"{name} detected on vulnerable PHP {php_version or '?'}; "
+                "upgrade PHP (and review app compatibility)."
+            )
+        elif php_version:
+            status = Status.PASS if php_status == "PASS" else Status.UNKNOWN
+            remediation = (
+                f"{name} detected; confirm PHP {php_version} is on a fixed branch."
+                if status != Status.PASS
+                else f"{name} detected; PHP version appears fixed."
+            )
+        else:
+            status = Status.UNKNOWN
+            remediation = f"{name} detected; PHP version not determined - run a PHP check."
+
+        findings.append(
+            Finding(
+                status=status,
+                cve="CVE-2026-109618/CVE-2026-109619",
+                target=str(root),
+                installed=f"{name}" + (f" {version_hint}" if version_hint else ""),
+                fixed="PHP fixed branch (see php check)",
+                remediation=remediation,
+                detail="application_stack",
+                extra={"app": name, "app_version": version_hint, "php_version": php_version},
+            )
+        )
+    return findings