[AIG-Bot] 新增漏洞规则 2026-07-24（235 条 CVE + 12 条指纹）

data/fingerprints/agentic-flow.yaml

@@ -0,0 +1,20 @@
+info:
+  name: Agentic-Flow
+  author: A.I.G bot
+  severity: info
+  desc: Agentic-Flow is a production-ready AI agent orchestration platform with specialized agents, MCP tools, and autonomous multi-agent swarms, exposing HTTP/SSE and health endpoints
+  metadata:
+    product: agentic-flow
+    vendor: ruvnet
+http:
+  - method: GET
+    path: /health
+    matchers:
+      - body="\"checks\":" && body="\"api\":" && body="\"memory\":" && body="\"uptime\":" && body="\"version\":"
+version:
+  - method: GET
+    path: /health
+    extractor:
+      part: body
+      group: 1
+      regex: '"version"\s*:\s*"([0-9][0-9.a-zA-Z\-]+)"'

data/fingerprints/agenticmail.yaml

@@ -0,0 +1,20 @@
+info:
+  name: AgenticMail
+  author: A.I.G bot
+  severity: info
+  desc: AgenticMail gives AI agents real email addresses and phone numbers. REST API server with Express for email, SMS, and phone call-control endpoints for AI agents.
+  metadata:
+    product: agenticmail
+    vendor: agenticmail
+http:
+  - method: GET
+    path: /api/agenticmail/health
+    matchers:
+      - body="\"version\"" && body="\"services\"" && body="\"stalwart\"" && header="AgenticMail"
+version:
+  - method: GET
+    path: /api/agenticmail/health
+    extractor:
+      part: body
+      group: 1
+      regex: '"version"\s*:\s*"([0-9][0-9.a-zA-Z\-]+)"'

data/fingerprints/ai-copilot.yaml

@@ -0,0 +1,25 @@
+info:
+  name: AI Copilot
+  author: A.I.G bot
+  severity: info
+  desc: >-
+    AI Copilot is a WordPress plugin by QuadLayers that provides AI-driven
+    chatbot, content generation, and MCP tool capabilities. It integrates with
+    OpenAI GPT models for automated content creation, SEO improvement, and
+    editor utilities, and exposes privileged MCP tools for AI assistant
+    interactions via OAuth-authenticated REST API endpoints.
+  metadata:
+    product: ai-copilot
+    vendor: quadlayers
+http:
+  - method: GET
+    path: '/'
+    matchers:
+      - body="aicp__chatbot" && body="aicp__app"
+version:
+  - method: GET
+    path: '/wp-content/plugins/ai-copilot/readme.txt'
+    extractor:
+      part: body
+      group: 1
+      regex: 'Stable tag:\s*([0-9][0-9.]*)'

data/fingerprints/aptabase.yaml

@@ -0,0 +1,28 @@
+info:
+  name: aptabase
+  author: A.I.G bot
+  severity: info
+  desc: Aptabase is an open-source, privacy-first analytics platform for apps. It provides a simple API to track events and offers a dashboard to visualize analytics data.
+  metadata:
+    product: aptabase
+    vendor: aptabase
+http:
+  - method: GET
+    path: '/'
+    matchers:
+      - body="<title>Aptabase</title>" || body="aptabase" && body="analytics"
+  - method: GET
+    path: '/api/health'
+    matchers:
+      - status==200 && (body="ok" || body="healthy")
+  - method: GET
+    path: '/swagger'
+    matchers:
+      - body="Aptabase" && body="swagger"
+version:
+  - method: GET
+    path: '/api/health'
+    extractor:
+      part: body
+      group: 1
+      regex: '"version":\\s*"(\\d+\\.\\d+\\.\\d+[^"]*)"'

data/fingerprints/gpt-sovits.yaml

@@ -0,0 +1,24 @@
+info:
+  name: gpt-sovits
+  author: 腾讯朱雀实验室
+  severity: info
+  desc: GPT-SoVITS 是一款开源的语音合成与语音转换项目，支持少样本语音克隆，提供基于 Gradio 的 WebUI 界面。
+  metadata:
+    product: gpt-sovits
+    vendor: RVC-Boss
+http:
+  - method: GET
+    path: '/'
+    matchers:
+      - body="GPT-SoVITS" && body="gradio"
+  - method: GET
+    path: '/config'
+    matchers:
+      - body="GPT-SoVITS"
+version:
+  - method: GET
+    path: '/'
+    extractor:
+      part: body
+      group: 1
+      regex: 'GPT-SoVITS[_\s]+v?(\d{8}v?\d*(?:pro)?)'

data/fingerprints/hyperdx.yaml

@@ -0,0 +1,26 @@
+info:
+  name: hyperdx
+  author: A.I.G bot
+  severity: info
+  desc: HyperDX is an open-source observability platform for logs, metrics, traces,
+    and session replays, built on ClickHouse for high-performance data storage.
+  metadata:
+    product: hyperdx
+    vendor: hyperdxio
+http:
+- method: GET
+  path: /
+  matchers:
+  - body="HyperDX" && body="<title>"
+- method: GET
+  path: /api/v1/search
+  matchers:
+  - status=401 || status=403
+  - body="hyperdx" || body="HyperDX"
+version:
+- method: GET
+  path: /api/version
+  extractor:
+    part: body
+    group: 1
+    regex: '"version":"([0-9]+\.[0-9]+\.[0-9]+[^"]*)"'

data/fingerprints/langbot.yaml

@@ -0,0 +1,20 @@
+info:
+  name: langbot
+  author: Tencent Zhusuo Lab
+  severity: info
+  desc: LangBot - Production-grade platform for building agentic IM bots
+  metadata:
+    product: langbot
+    vendor: langbot
+http:
+  - method: GET
+    path: '/login'
+    matchers:
+      - body="<title>LangBot</title>" && body="Production-grade platform for building agentic IM bots"
+version:
+  - method: GET
+    path: '/api/v1/system/info'
+    extractor:
+      part: body
+      group: 1
+      regex: '"version"\s*:\s*"v?([0-9][0-9.]*)"'

data/fingerprints/lightrag.yaml

@@ -0,0 +1,24 @@
+info:
+  name: LightRAG
+  author: 腾讯科恩实验室
+  severity: info
+  desc: LightRAG是一个简单快速的检索增强生成(RAG)框架，提供FastAPI REST API服务，支持文档管理、查询和图操作。
+  metadata:
+    product: LightRAG
+    vendor: HKUDS
+http:
+  - method: GET
+    path: '/health'
+    matchers:
+      - body='"core_version"' && body='"api_version"' && body='"auth_mode"'
+  - method: GET
+    path: '/openapi.json'
+    matchers:
+      - body='"LightRAG Server API"'
+version:
+  - method: GET
+    path: '/health'
+    extractor:
+      part: body
+      group: 1
+      regex: '"core_version":"([0-9]+\.[0-9]+\.[0-9]+[^"]*)"'

data/fingerprints/mcp-documentation-server.yaml

@@ -0,0 +1,26 @@
+info:
+  name: mcp-documentation-server
+  author: A.I.G bot
+  severity: info
+  desc: MCP Documentation Server is a TypeScript-based MCP server providing local-first document management and AI-powered semantic search. It exposes an unauthenticated Web UI/API on port 3080.
+  metadata:
+    product: andrea9293
+    vendor: andrea9293
+http:
+  - method: GET
+    path: /
+    matchers:
+      - body="<title>MCP Documentation Server</title>"
+  - method: GET
+    path: /api/documents
+    matchers:
+      - body="documents" && header="application/json"
+# Fingerprint note:
+# The Web UI serves a single-page application at / with <title>MCP Documentation Server</title>.
+# The /api/documents endpoint returns a JSON array of documents (unauthenticated in vulnerable versions).
+# Default port: 3080.
+#
+# Version extraction: No dedicated /version or /health endpoint confirmed.
+# The server name/version can be found in:
+#   - package.json version (not exposed via API)
+#   - npm registry metadata (@andrea9293/mcp-documentation-server)

data/fingerprints/netlicensing-mcp.yaml

@@ -0,0 +1,30 @@
+info:
+  name: netlicensing-mcp
+  author: A.I.G bot
+  severity: info
+  desc: NetLicensing-MCP is an official MCP (Model Context Protocol) server from Labs64 that enables AI agents to manage software licensing lifecycle via the NetLicensing REST API. It exposes an unauthenticated health endpoint and a Streamable HTTP MCP endpoint.
+  metadata:
+    product: Labs64
+    vendor: Labs64
+http:
+  - method: GET
+    path: /health
+    matchers:
+      - body='"server":"netlicensing-mcp"' && body='"status":"ok"'
+  - method: POST
+    path: /mcp
+    matchers:
+      - body='"netlicensing-mcp"'
+# Fingerprint note:
+# The /health endpoint returns {"status":"ok","server":"netlicensing-mcp"} (unauthenticated).
+# The /mcp endpoint is the Streamable HTTP MCP transport; POST with a JSON-RPC initialize
+# request returns a response referencing "netlicensing-mcp" in the serverInfo.name field.
+# Default port: configurable via MCP_HOST/MCP_PORT env vars.
+#
+# Layer-1 (GitHub source code) verification:
+#   - /health response confirmed in server.py line 130-135 (v0.1.5) and line 166-172 (latest)
+#   - FastMCP("netlicensing-mcp") in server.py line 54 → serverInfo.name in MCP init response
+#
+# Version extraction: No dedicated /version endpoint confirmed.
+# Package version available via PyPI metadata (netlicensing-mcp) or
+# GitHub releases (Labs64/NetLicensing-MCP).

data/fingerprints/open-webui.yaml

@@ -0,0 +1,24 @@
+info:
+  name: openwebui
+  author: 腾讯朱雀实验室
+  severity: info
+  desc: 一个开源、自托管的AI平台，提供用户友好的本地运行大语言模型的界面，支持Ollama等运行器。
+  metadata:
+    product: open-webui
+    vendor: open-webui
+http:
+  - method: GET
+    path: '/'
+    matchers:
+      - body="<title>Open WebUI</title>"
+  - method: GET
+    path: '/api/config'
+    matchers:
+      - body="\"name\":\"Open WebUI\"" && body="\"features\":"
+version:
+  - method: GET
+    path: '/api/version'
+    extractor:
+      part: body
+      group: 1
+      regex: '"version":"(\d+\.\d+\.?\d+?)"'

data/fingerprints/wazuh.yaml

@@ -0,0 +1,25 @@
+info:
+  name: wazuh
+  author: A.I.G bot
+  severity: info
+  desc: Wazuh is a free and open source security monitoring platform used for threat prevention, detection, and response.
+  metadata:
+    product: wazuh
+    vendor: wazuh
+http:
+  - method: GET
+    path: "/"
+    matchers:
+      - body="<title>Wazuh</title>"
+  - method: GET
+    path: "/app/wazuh"
+    matchers:
+      - body="<title>Wazuh</title>"
+      - body="wazuh"
+version:
+  - method: GET
+    path: "/api/v1/info"
+    extractor:
+      part: body
+      group: 1
+      regex: '"version"\s*:\s*"([0-9][0-9.]*)"'

data/vuln/LiteLLM/CVE-2026-30623.yaml

@@ -0,0 +1,24 @@
+info:
+  name: LiteLLM
+  cve: CVE-2026-30623
+  summary: LiteLLM MCP 服务器创建功能认证后远程代码执行漏洞
+  details: LiteLLM 1.83.6 之前版本存在认证后远程代码执行漏洞，该漏洞位于 MCP 服务器创建功能中。应用程序允许用户通过
+    JSON 配置添加 MCP 服务器，配置中可指定任意的 command 和 args 值。当添加传输类型为 stdio 的 MCP 服务器时，command
+    字段被直接传递给 StdioServerParameters 并在代理主机上作为子进程执行，未做任何验证。拥有创建 MCP 服务器权限的已认证用户可以以
+    LiteLLM 进程的权限执行任意操作系统命令。v1.83.6 版本的修复引入了命令白名单（MCP_STDIO_ALLOWED_COMMANDS），将
+    stdio 命令值限制为已知 MCP 启动器（npx、uvx、python、python3、node、docker、deno），在 NewMCPServerRequest
+    和 UpdateMCPServerRequest 上添加了 Pydantic 级别验证，并将 /mcp-rest/test/* 预览端点限制为需要 PROXY_ADMIN
+    角色。
+  cvss: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+  severity: CRITICAL
+  security_advise: 建议升级至 LiteLLM v1.83.7-stable 或更高版本（或 v1.83.6-nightly 及以上）。审计现有
+    MCP 服务器配置，确保其 command 基名在白名单中。审查哪些用户持有 PROXY_ADMIN 角色。
+  references:
+  - https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026
+  - https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/
+  - https://github.com/BerriAI/litellm/pull/25343
+rule: version < "1.83.6"
+references:
+- https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026
+- https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/
+- https://github.com/BerriAI/litellm/pull/25343

data/vuln/agentic-flow/CVE-2026-58195.yaml

@@ -0,0 +1,30 @@
+info:
+  name: Agentic-Flow
+  cve: CVE-2026-58195
+  summary: agentic-flow MCP server 工具因未过滤参数直接拼入 execSync 导致操作系统命令注入
+  details: >-
+    Agentic-Flow 2.0.14 之前版本存在严重的操作系统命令注入漏洞（CWE-78）。受影响文件包括
+    standalone-stdio.ts、claude-flow-sdk.ts、stdio-full.ts、http-streaming-updated.ts、http-sse.ts、
+    poc-stdio.ts 以及 fastmcp/tools/ 下的多个工具文件，这些文件将攻击者可控的工具参数（agent、task、
+    name、language、agentdb 参数等）直接拼接到传递给 Node.js execSync() 的 shell 命令字符串中。
+    恶意参数值可以突破双引号包裹，以 MCP 服务器进程的权限执行任意操作系统命令。HTTP/SSE 传输方式
+    （http-sse.ts、http-streaming-updated.ts）在无认证且无 Origin/Host 校验的情况下暴露了相同的
+    命令注入点，当部署在可达网络接口上时可能提升实际危害等级。此漏洞属于部分修复遗留：先前提交
+    6a06854（#158）修复了项目中其他位置的 CWE-78 问题，但遗漏了 MCP 服务器文件。2.0.14 版本的修复
+    将所有受影响的调用点改写为使用 execFileSync(file, argv, {shell: false})，使攻击者控制的参数
+    直接传递给 execve(2) 而不经 shell 解析。同时新增回归测试（tests/security/cwe-78-mcp-execsync.test.ts），
+    静态扫描所有 src/mcp/**/*.ts 文件，若重新引入 execSync() 调用则构建失败。利用成熟度：低——暂无
+    公开可用的利用工具，但安全公告中已提供 PoC，漏洞利用方式较为直接。
+  cvss:
+    vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+    score: 8.8
+  severity: HIGH
+  security_advise: >-
+    立即升级至 agentic-flow >= 2.0.14。无其他产品内配置可缓解此漏洞。若 MCP HTTP/SSE 传输部署在可达
+    网络接口上，在升级完成前应确保其不暴露于不受信任的网络。下游包（ruflo、claude-flow、@claude-flow/cli）
+    已在 3.12.4 版本中固定使用修复版本。
+rule: version < "2.0.14"
+references:
+  - https://github.com/ruvnet/agentic-flow/security/advisories/GHSA-vcv2-r9jh-99m5
+  - https://github.com/ruvnet/agentic-flow/pull/170
+  - https://github.com/ruvnet/agentic-flow/commit/0c2ec967736a8b6b85832c6bae2a3e74989705ec

data/vuln/agenticmail/CVE-2026-47255.yaml

@@ -0,0 +1,23 @@
+info:
+  name: AgenticMail
+  cve: CVE-2026-47255
+  summary: AgenticMail API 和核心模块存在多项输入验证、访问控制和加固缺陷，包括 SQL 注入、硬编码凭据、明文传输和不当访问控制
+  details: >-
+    AgenticMail 是一个为 AI 代理提供真实邮箱地址和电话号码的平台。@agenticmail/api 0.9.32 之前的版本和 @agenticmail/core 0.9.10 之前的版本存在以下安全缺陷：（1）非活跃代理小时过滤的验证和绑定问题；（2）存储 SQL 标识符验证不足（SQL 注入风险，CWE-89）；（3）原始存储 SQL 的元数据所有权检查缺失（不当访问控制，CWE-284）；（4）未阻止通过原始 SQL 直接访问存储元数据；（5）出站工作线程密钥处理未采用故障关闭模式（使用硬编码凭据，CWE-798）；（6）SMTP 信封/信头控制字符在命令构建前未做验证（不当输入验证，CWE-20）；（7）MailSender 默认未启用 TLS 证书验证，仅在本地开发时可选择退出（敏感信息明文传输，CWE-319）。这些问题已在 @agenticmail/api 0.9.32 和 @agenticmail/core 0.9.10 中修复。
+
+    注意：AgenticMail 指纹通过 /api/agenticmail/health 端点提供版本提取器，返回 @agenticmail/api 包版本号。受影响版本为 @agenticmail/api < 0.9.32 和 @agenticmail/core < 0.9.10。由于 API 包版本对外暴露且 core 版本打包在 API 包内（api v0.9.32 包含 core v0.9.10+），因此规则条件使用 API 版本作为可检测边界。
+  cvss:
+    vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
+    score: 8.2
+  severity: HIGH
+  security_advise: >-
+    将 @agenticmail/api 升级至 0.9.32 或更高版本，将 @agenticmail/core 升级至 0.9.10 或更高版本。确保出站邮件启用 TLS 证书验证。审查 SQL 查询是否已参数化并验证所有 SQL 标识符。通过适当的 API 端点限制元数据访问，而非允许原始 SQL 操作。
+  references:
+    - https://github.com/agenticmail/agenticmail/security/advisories/GHSA-wjjv-3mj2-39hf
+    - https://github.com/agenticmail/agenticmail/commit/1408de543fa3577d8c2d4fdb289c75fe6faafac7
+    - https://github.com/agenticmail/agenticmail/commit/234b811e426a0743170f3b10bc43419d64330155
+    - https://github.com/agenticmail/agenticmail/commit/6c70c8254c906f823392d7f5ccee88a5481e7731
+    - https://github.com/agenticmail/agenticmail/commit/8cb053f2307dd77b7736ffa0d7df04b0ccc3272d
+rule: version < "0.9.32"
+references:
+  - https://github.com/agenticmail/agenticmail/security/advisories/GHSA-wjjv-3mj2-39hf